farrokhi/nfdump
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Update sflow code to commit 7322984 of https://github.com/sflow/sflowtool

Browse Source
This commit is contained in:
Peter Haag 2017-12-27 19:56:21 +01:00
parent c4e8a5b517
commit eaa7a857c8
31 changed files with 6847 additions and 4322 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
ChangeLog
View File

@ -1,3 +1,7 @@
2017-12-27
- Add ipfix delta timestamp elements 158/159.
- Update sflow code to commit 7322984 of https://github.com/sflow/sflowtool
2017-12-22
- Fix potential memory leaks in nfpcapd

2
bin/Makefile.am
View File

@ -111,7 +111,7 @@ nfpcapd_LDADD += -lpcap
nfpcapd_LDFLAGS = -pthread
endif
sfcapd_SOURCES = sfcapd.c sflow.c sflow.h sflow_proto.h \
sfcapd_SOURCES = sfcapd.c sflow_nfdump.c sflow_nfdump.h sflow.h sflow_v2v4.h \
$(nfstatfile) $(launch) \
$(nfnet) $(collector) $(bookkeeper) $(expire)
sfcapd_LDADD = -lnfdump

22
bin/applybits_inline.c
View File

@ -1,4 +1,5 @@
/*
* Copyright (c) 2017, Peter Haag
* Copyright (c) 2014, Peter Haag
* Copyright (c) 2009, Peter Haag
* Copyright (c) 2004-2008, SWITCH - Teleinformatikdienste fuer Lehre und Forschung
@ -28,11 +29,6 @@
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
* POSSIBILITY OF SUCH DAMAGE.
*
* $Author: haag $
*
* $Id: applybits_inline.c 39 2009-11-25 08:11:15Z haag $
*
* $LastChangedRevision: 39 $
*
*/
@ -46,11 +42,11 @@ static inline void ApplyNetMaskBits(master_record_t *flow_record, int apply_netb
uint32_t mask_bits = flow_record->src_mask;
if ( mask_bits > 64 ) {
mask = 0xffffffffffffffffLL << ( 128 - mask_bits );
flow_record->v6.srcaddr[1] &= mask;
flow_record->V6.srcaddr[1] &= mask;
} else {
mask = 0xffffffffffffffffLL << ( 64 - mask_bits );
flow_record->v6.srcaddr[0] &= mask;
flow_record->v6.srcaddr[1] = 0;
flow_record->V6.srcaddr[0] &= mask;
flow_record->V6.srcaddr[1] = 0;
}
}
if ( apply_netbits & 2 ) {
@ -59,21 +55,21 @@ static inline void ApplyNetMaskBits(master_record_t *flow_record, int apply_netb
if ( mask_bits > 64 ) {
mask = 0xffffffffffffffffLL << ( 128 - mask_bits );
flow_record->v6.dstaddr[1] &= mask;
flow_record->V6.dstaddr[1] &= mask;
} else {
mask = 0xffffffffffffffffLL << ( 64 - mask_bits );
flow_record->v6.dstaddr[0] &= mask;
flow_record->v6.dstaddr[1] = 0;
flow_record->V6.dstaddr[0] &= mask;
flow_record->V6.dstaddr[1] = 0;
}
}
} else { // IPv4
if ( apply_netbits & 1 ) {
uint32_t srcmask = 0xffffffff << ( 32 - flow_record->src_mask );
flow_record->v4.srcaddr &= srcmask;
flow_record->V4.srcaddr &= srcmask;
}
if ( apply_netbits & 2 ) {
uint32_t dstmask = 0xffffffff << ( 32 - flow_record->dst_mask );
flow_record->v4.dstaddr &= dstmask;
flow_record->V4.dstaddr &= dstmask;
}
}

30
bin/collector.c
View File

@ -155,15 +155,15 @@ int ok;
uint64_t _ip[2];
ok = inet_pton(PF_INET6, p, _ip);
(*source)->sa_family = PF_INET6;
(*source)->ip.v6[0] = ntohll(_ip[0]);
(*source)->ip.v6[1] = ntohll(_ip[1]);
(*source)->ip.V6[0] = ntohll(_ip[0]);
(*source)->ip.V6[1] = ntohll(_ip[1]);
} else {
uint32_t _ip;
ok = inet_pton(PF_INET, p, &_ip);
(*source)->sa_family = PF_INET;
(*source)->ip.v6[0] = 0;
(*source)->ip.v6[1] = 0;
(*source)->ip.v4 = ntohl(_ip);
(*source)->ip.V6[0] = 0;
(*source)->ip.V6[1] = 0;
(*source)->ip.V4 = ntohl(_ip);
}
switch (ok) {
case 0:
@ -339,9 +339,9 @@ int err;
}
#endif
(*source)->sa_family = PF_INET;
(*source)->ip.v6[0] = 0;
(*source)->ip.v6[1] = 0;
(*source)->ip.v4 = ntohl(u.sa_in->sin_addr.s_addr);
(*source)->ip.V6[0] = 0;
(*source)->ip.V6[1] = 0;
(*source)->ip.V4 = ntohl(u.sa_in->sin_addr.s_addr);
ptr = &u.sa_in->sin_addr;
} break;
case PF_INET6: {
@ -358,14 +358,14 @@ int err;
#endif
// ptr = &((struct sockaddr_in6 *)sa)->sin6_addr;
(*source)->sa_family = PF_INET6;
(*source)->ip.v6[0] = ntohll(ip_ptr[0]);
(*source)->ip.v6[1] = ntohll(ip_ptr[1]);
(*source)->ip.V6[0] = ntohll(ip_ptr[0]);
(*source)->ip.V6[1] = ntohll(ip_ptr[1]);
ptr = &u.sa_in6->sin6_addr;
} break;
default:
// keep compiler happy
(*source)->ip.v6[0] = 0;
(*source)->ip.v6[1] = 0;
(*source)->ip.V6[0] = 0;
(*source)->ip.V6[1] = 0;
ptr = NULL;
LogError("Unknown sa fanily: %d in '%s', line '%d'", ss->ss_family, __FILE__, __LINE__ );
@ -530,14 +530,14 @@ int FlushInfoExporter(FlowSource_t *fs, exporter_info_record_t *exporter) {
char ipstr[IP_STRING_LEN];
printf("Flush Exporter: ");
if ( exporter->sa_family == AF_INET ) {
uint32_t _ip = htonl(exporter->ip.v4);
uint32_t _ip = htonl(exporter->ip.V4);
inet_ntop(AF_INET, &_ip, ipstr, sizeof(ipstr));
printf("SysID: %u, IP: %16s, version: %u, ID: %2u\n", exporter->sysid,
ipstr, exporter->version, exporter->id);
} else if ( exporter->sa_family == AF_INET6 ) {
uint64_t _ip[2];
_ip[0] = htonll(exporter->ip.v6[0]);
_ip[1] = htonll(exporter->ip.v6[1]);
_ip[0] = htonll(exporter->ip.V6[0]);
_ip[1] = htonll(exporter->ip.V6[1]);
inet_ntop(AF_INET6, &_ip, ipstr, sizeof(ipstr));
printf("SysID: %u, IP: %40s, version: %u, ID: %2u\n", exporter->sysid,
ipstr, exporter->version, exporter->id);

23
bin/collector_inline.c
View File

@ -1,4 +1,5 @@
/*
* Copyright (c) 2017, Peter Haag
* Copyright (c) 2014, Peter Haag
* Copyright (c) 2009, Peter Haag
* Copyright (c) 2008, SWITCH - Teleinformatikdienste fuer Lehre und Forschung
@ -28,12 +29,6 @@
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
* POSSIBILITY OF SUCH DAMAGE.
*
* $Author: haag $
*
* $Id: collector_inline.c 37 2009-11-10 08:40:30Z haag $
*
* $LastChangedRevision: 37 $
*
*/
static inline FlowSource_t *GetFlowSource(struct sockaddr_storage *ss) {
@ -59,9 +54,9 @@ char as[100];
return NULL;
}
#endif
ip.v6[0] = 0;
ip.v6[1] = 0;
ip.v4 = ntohl(u.sa_in->sin_addr.s_addr);
ip.V6[0] = 0;
ip.V6[1] = 0;
ip.V4 = ntohl(u.sa_in->sin_addr.s_addr);
ptr = &u.sa_in->sin_addr;
} break;
case PF_INET6: {
@ -75,14 +70,14 @@ char as[100];
}
#endif
// ptr = &((struct sockaddr_in6 *)sa)->sin6_addr;
ip.v6[0] = ntohll(ip_ptr[0]);
ip.v6[1] = ntohll(ip_ptr[1]);
ip.V6[0] = ntohll(ip_ptr[0]);
ip.V6[1] = ntohll(ip_ptr[1]);
ptr = &u.sa_in6->sin6_addr;
} break;
default:
// keep compiler happy
ip.v6[0] = 0;
ip.v6[1] = 0;
ip.V6[0] = 0;
ip.V6[1] = 0;
ptr = NULL;
LogError("Unknown sa fanily: %d in '%s', line '%d'", ss->ss_family, __FILE__, __LINE__ );
@ -97,7 +92,7 @@ char as[100];
fs = FlowSource;
while ( fs ) {
if ( ip.v6[0] == fs->ip.v6[0] && ip.v6[1] == fs->ip.v6[1] )
if ( ip.V6[0] == fs->ip.V6[0] && ip.V6[1] == fs->ip.V6[1] )
return fs;
// if we match any source, store the current IP address - works as faster cache next time

18
bin/exporter.c
View File

@ -151,14 +151,14 @@ char *p1, *p2;
#define IP_STRING_LEN 40
char ipstr[IP_STRING_LEN];
if ( exporter_record->sa_family == AF_INET ) {
uint32_t _ip = htonl(exporter_record->ip.v4);
uint32_t _ip = htonl(exporter_record->ip.V4);
inet_ntop(AF_INET, &_ip, ipstr, sizeof(ipstr));
printf("SysID: %u, IP: %16s, version: %u, ID: %2u, Slot: %u\n", exporter_record->sysid,
ipstr, exporter_record->version, exporter_record->id, id);
} else if ( exporter_record->sa_family == AF_INET6 ) {
uint64_t _ip[2];
_ip[0] = htonll(exporter_record->ip.v6[0]);
_ip[1] = htonll(exporter_record->ip.v6[1]);
_ip[0] = htonll(exporter_record->ip.V6[0]);
_ip[1] = htonll(exporter_record->ip.V6[1]);
inet_ntop(AF_INET6, &_ip, ipstr, sizeof(ipstr));
printf("SysID: %u, IP: %40s, version: %u, ID: %2u, Slot: %u\n", exporter_record->sysid,
ipstr, exporter_record->version, exporter_record->id, id);
@ -347,14 +347,14 @@ uint64_t total_bytes;
found = 1;
printf("\n");
if ( exporter_record->sa_family == AF_INET ) {
uint32_t _ip = htonl(exporter_record->ip.v4);
uint32_t _ip = htonl(exporter_record->ip.V4);
inet_ntop(AF_INET, &_ip, ipstr, sizeof(ipstr));
printf("SysID: %u, IP: %16s, version: %u, ID: %2u, Sequence Failures: %u\n", exporter_record->sysid,
ipstr, exporter_record->version, exporter_record->exporter_id, exporter_record->sequence_failure);
} else if ( exporter_record->sa_family == AF_INET6 ) {
uint64_t _ip[2];
_ip[0] = htonll(exporter_record->ip.v6[0]);
_ip[1] = htonll(exporter_record->ip.v6[1]);
_ip[0] = htonll(exporter_record->ip.V6[0]);
_ip[1] = htonll(exporter_record->ip.V6[1]);
inet_ntop(AF_INET6, &_ip, ipstr, sizeof(ipstr));
printf("SysID: %u, IP: %40s, version: %u, ID: %2u, Sequence Failures: %u\n", exporter_record->sysid,
ipstr, exporter_record->version, exporter_record->exporter_id, exporter_record->sequence_failure);
@ -410,7 +410,7 @@ uint64_t total_bytes;
printf("\n");
exporter = &exporter_list[i]->info;
if ( exporter->sa_family == AF_INET ) {
uint32_t _ip = htonl(exporter->ip.v4);
uint32_t _ip = htonl(exporter->ip.V4);
inet_ntop(AF_INET, &_ip, ipstr, sizeof(ipstr));
if ( exporter_list[i]->flows )
printf("SysID: %u, IP: %16s, version: %u, ID: %2u, Sequence failures: %u, packets: %llu, flows: %llu\n",
@ -424,8 +424,8 @@ uint64_t total_bytes;
} else if ( exporter->sa_family == AF_INET6 ) {
uint64_t _ip[2];
_ip[0] = htonll(exporter->ip.v6[0]);
_ip[1] = htonll(exporter->ip.v6[1]);
_ip[0] = htonll(exporter->ip.V6[0]);
_ip[1] = htonll(exporter->ip.V6[1]);
inet_ntop(AF_INET6, &_ip, ipstr, sizeof(ipstr));
if ( exporter_list[i]->flows )
printf("SysID: %u, IP: %40s, version: %u, ID: %2u, Sequence failures: %u, packets: %llu, flows: %llu\n ",

9
bin/ft2nfdump.c
View File

@ -1,5 +1,6 @@
/*
* All rights reserved.
* Copyright (c) 2017, Peter Haag
* Copyright (c) 2016, Peter Haag
* Copyright (c) 2014, Peter Haag
* Copyright (c) 2009, Peter Haag
@ -238,8 +239,8 @@ uint32_t cnt;
record.last = ftt.secs;
record.msec_last = ftt.msecs;
record.v4.srcaddr = *((uint32_t*)(rec+fo.srcaddr));
record.v4.dstaddr = *((uint32_t*)(rec+fo.dstaddr));
record.V4.srcaddr = *((uint32_t*)(rec+fo.srcaddr));
record.V4.dstaddr = *((uint32_t*)(rec+fo.dstaddr));
record.srcport = *((uint16_t*)(rec+fo.srcport));
record.dstport = *((uint16_t*)(rec+fo.dstport));
@ -268,10 +269,10 @@ uint32_t cnt;
record.dst_tos = 0;
break;
case EX_ROUTER_IP_v4:
record.ip_nexthop.v4 = *((uint32_t*)(rec+fo.peer_nexthop));
record.ip_nexthop.V4 = *((uint32_t*)(rec+fo.peer_nexthop));
break;
case EX_NEXT_HOP_v4:
record.ip_router.v4 = *((uint32_t*)(rec+fo.router_sc));
record.ip_router.V4 = *((uint32_t*)(rec+fo.router_sc));
break;
case EX_ROUTER_ID:
record.engine_type = *((uint8_t*)(rec+fo.engine_type));

70
bin/ipfix.c
View File

@ -28,12 +28,6 @@
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
* POSSIBILITY OF SUCH DAMAGE.
*
* $Author:$
*
* $Id:$
*
* $LastChangedRevision:$
*
*/
#include "config.h"
@ -106,12 +100,13 @@ typedef struct sequence_map_s {
#define move_mac 11
#define move_mpls 12
#define Time64Mili 13
#define saveICMP 14
#define zero8 15
#define zero16 16
#define zero32 17
#define zero64 18
#define zero128 19
#define TimeDeltaMicro 14
#define saveICMP 15
#define zero8 16
#define zero16 17
#define zero32 18
#define zero64 19
#define zero128 20
uint32_t id; // sequence ID as defined above
uint16_t input_offset; // copy/process data at this input offset
@ -135,6 +130,7 @@ typedef struct input_translation_s {
uint32_t output_record_size; // required size in nfdump format
// tmp vars needed while processing the data record
int delta_time; // delta micro or absolute ms time stamps
uint64_t flow_start; // start time in msec
uint64_t flow_end; // end time in msec
uint32_t ICMP_offset; // offset of ICMP type/code in data stream
@ -266,6 +262,8 @@ static struct ipfix_element_map_s {
{ IPFIX_postSourceMacAddress, _6bytes, _8bytes, move_mac, zero64, EX_MAC_2},
{ IPFIX_flowStartMilliseconds, _8bytes, _8bytes, Time64Mili, zero32, COMMON_BLOCK},
{ IPFIX_flowEndMilliseconds, _8bytes, _8bytes, Time64Mili, zero32, COMMON_BLOCK},
{ IPFIX_flowStartDeltaMicroseconds, _4bytes, _4bytes, TimeDeltaMicro, zero32, COMMON_BLOCK},
{ IPFIX_flowEndDeltaMicroseconds, _4bytes, _4bytes, TimeDeltaMicro, zero32, COMMON_BLOCK},
{0, 0, 0}
};
@ -319,6 +317,8 @@ static inline void Process_ipfix_template_withdraw(exporter_ipfix_domain_t *expo
static inline void Process_ipfix_option_data(exporter_ipfix_domain_t *exporter, void *data_flowset, FlowSource_t *fs);
static inline void Process_ipfix_data(exporter_ipfix_domain_t *exporter, uint32_t ExportTime, void *data_flowset, FlowSource_t *fs, input_translation_t *table );
#include "inline.c"
#include "nffile_inline.c"
@ -356,18 +356,18 @@ uint32_t ObservationDomain = ntohl(ipfix_header->ObservationDomain);
while ( *e ) {
if ( (*e)->info.id == ObservationDomain && (*e)->info.version == 10 &&
(*e)->info.ip.v6[0] == fs->ip.v6[0] && (*e)->info.ip.v6[1] == fs->ip.v6[1])
(*e)->info.ip.V6[0] == fs->ip.V6[0] && (*e)->info.ip.V6[1] == fs->ip.V6[1])
return *e;
e = &((*e)->next);
}
if ( fs->sa_family == AF_INET ) {
uint32_t _ip = htonl(fs->ip.v4);
uint32_t _ip = htonl(fs->ip.V4);
inet_ntop(AF_INET, &_ip, ipstr, sizeof(ipstr));
} else if ( fs->sa_family == AF_INET6 ) {
uint64_t _ip[2];
_ip[0] = htonll(fs->ip.v6[0]);
_ip[1] = htonll(fs->ip.v6[1]);
_ip[0] = htonll(fs->ip.V6[0]);
_ip[1] = htonll(fs->ip.V6[1]);
inet_ntop(AF_INET6, &_ip, ipstr, sizeof(ipstr));
} else {
strncpy(ipstr, "<unknown>", IP_STRING_LEN);
@ -637,7 +637,8 @@ size_t size_required;
table->flags = 0;
SetFlag(table->flags, FLAG_PKG_64);
SetFlag(table->flags, FLAG_BYTES_64);
table->ICMP_offset = 0;
table->delta_time = 0;
table->ICMP_offset = 0;
// table->sampler_offset = 0;
// table->sampler_size = 0;
// table->engine_offset = 0;
@ -658,10 +659,20 @@ size_t size_required;
// The order we Push all ipfix elements, must corresponde to the structure of the common record
// followed by all available extension in the extension map
offset = BYTE_OFFSET_first;
PushSequence( table, IPFIX_flowStartMilliseconds, &offset, &table->flow_start);
offset = BYTE_OFFSET_first + 4;
PushSequence( table, IPFIX_flowEndMilliseconds, &offset, &table->flow_end);
offset = BYTE_OFFSET_first + 8;
if ( cache.lookup_info[IPFIX_flowStartDeltaMicroseconds].found ) {
PushSequence( table, IPFIX_flowStartDeltaMicroseconds, &offset, &table->flow_start);
offset = BYTE_OFFSET_first + 4;
PushSequence( table, IPFIX_flowEndDeltaMicroseconds, &offset, &table->flow_end);
offset = BYTE_OFFSET_first + 8;
table->delta_time = 1;
dbg_printf("Time stamp: flow start/end delta microseconds\n");
} else if ( cache.lookup_info[IPFIX_flowStartMilliseconds].found ) {
PushSequence( table, IPFIX_flowStartMilliseconds, &offset, &table->flow_start);
offset = BYTE_OFFSET_first + 4;
PushSequence( table, IPFIX_flowEndMilliseconds, &offset, &table->flow_end);
offset = BYTE_OFFSET_first + 8;
dbg_printf("Time stamp: flow start/end absolute milliseconds\n");
}
offset +=1; // Skip netflow v9 fwd status
PushSequence( table, IPFIX_tcpControlBits, &offset, NULL);
PushSequence( table, IPFIX_protocolIdentifier, &offset, NULL);
@ -1133,7 +1144,7 @@ uint16_t Offset = 0;
fs->sa_family == PF_INET6 ? "ipv6" : "ipv4", EX_ROUTER_IP_v4);
}
// XXX for now, we do not stre router ID in IPFIX
// XXX for now, we do not store router ID in IPFIX
extension_descriptor[EX_ROUTER_ID].enabled = 0;
/*
@ -1380,7 +1391,7 @@ uint16_t offset_std_sampler_interval, offset_std_sampler_algorithm, found_std_sa
} // End of Process_ipfix_option_templates
static inline void Process_ipfix_data(exporter_ipfix_domain_t *exporter, void *data_flowset, FlowSource_t *fs, input_translation_t *table ){
static inline void Process_ipfix_data(exporter_ipfix_domain_t *exporter, uint32_t ExportTime, void *data_flowset, FlowSource_t *fs, input_translation_t *table ){
uint64_t sampling_rate;
uint32_t size_left;
uint8_t *in, *out;
@ -1550,6 +1561,11 @@ char *string;
{ uint64_t DateMiliseconds = Get_val64((void *)&in[input_offset]);
*(uint64_t *)stack = DateMiliseconds;
} break;
case TimeDeltaMicro:
{ uint64_t DeltaMicroSec = Get_val32((void *)&in[input_offset]);
*(uint64_t *)stack = ((1000000LL * (uint64_t)ExportTime) - DeltaMicroSec) / 1000LL;
} break;
case move_mac:
/* 64bit access to potentially unaligned output buffer. use 2 x 32bit for _LP64 CPUs */
@ -1621,15 +1637,15 @@ char *string;
// 64bit access to potentially unaligned output buffer. use 2 x 32bit for _LP64 CPUs
type_mask_t t;
t.val.val64 = exporter->info.ip.v6[0];
t.val.val64 = exporter->info.ip.V6[0];
*((uint32_t *)&out[output_offset]) = t.val.val32[0];
*((uint32_t *)&out[output_offset+4]) = t.val.val32[1];
t.val.val64 = exporter->info.ip.v6[1];
t.val.val64 = exporter->info.ip.V6[1];
*((uint32_t *)&out[output_offset+8]) = t.val.val32[0];
*((uint32_t *)&out[output_offset+12]) = t.val.val32[1];
} else {
*((uint32_t *)&out[output_offset]) = exporter->info.ip.v4;
*((uint32_t *)&out[output_offset]) = exporter->info.ip.V4;
}
}
@ -1892,7 +1908,7 @@ static uint32_t packet_cntr = 0;
dbg_printf("Process data flowset, length: %u\n", flowset_length);
table = GetTranslationTable(exporter, flowset_id);
if ( table ) {
Process_ipfix_data(exporter, flowset_header, fs, table);
Process_ipfix_data(exporter, ExportTime, flowset_header, fs, table);
exporter->DataRecords++;
} else if ( HasOptionTable(fs, flowset_id) ) {
Process_ipfix_option_data(exporter, flowset_header, fs);

10
bin/ipfix.h
View File

@ -1,4 +1,5 @@
/*
* Copyright (c) 2017, Peter Haag
* Copyright (c) 2014, Peter Haag
* Copyright (c) 2009, Peter Haag
* All rights reserved.
@ -27,12 +28,6 @@
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
* POSSIBILITY OF SUCH DAMAGE.
*
* $Author:$
*
* $Id:$
*
* $LastChangedRevision:$
*
*/
#ifndef _IPFIX_H
@ -260,7 +255,8 @@ typedef struct ipfix_template_elements_e_s {
#define IPFIX_packetTotalCount 86
#define IPFIX_flowStartMilliseconds 152
#define IPFIX_flowEndMilliseconds 153
// reserved 89
#define IPFIX_flowStartDeltaMicroseconds 158
#define IPFIX_flowEndDeltaMicroseconds 159
/* prototypes */
int Init_IPFIX(void);

10
bin/netflow_v1.c
View File

@ -177,7 +177,7 @@ char ipstr[IP_STRING_LEN];
// search the appropriate exporter engine
while ( *e ) {
if ( (*e)->info.version == version &&
(*e)->info.ip.v6[0] == fs->ip.v6[0] && (*e)->info.ip.v6[1] == fs->ip.v6[1])
(*e)->info.ip.V6[0] == fs->ip.V6[0] && (*e)->info.ip.V6[1] == fs->ip.V6[1])
return *e;
e = &((*e)->next);
}
@ -223,12 +223,12 @@ char ipstr[IP_STRING_LEN];
FlushInfoExporter(fs, &((*e)->info));
if ( fs->sa_family == AF_INET ) {
uint32_t _ip = htonl(fs->ip.v4);
uint32_t _ip = htonl(fs->ip.V4);
inet_ntop(AF_INET, &_ip, ipstr, sizeof(ipstr));
} else if ( fs->sa_family == AF_INET6 ) {
uint64_t _ip[2];
_ip[0] = htonll(fs->ip.v6[0]);
_ip[1] = htonll(fs->ip.v6[1]);
_ip[0] = htonll(fs->ip.V6[0]);
_ip[1] = htonll(fs->ip.V6[1]);
inet_ntop(AF_INET6, &_ip, ipstr, sizeof(ipstr));
} else {
strncpy(ipstr, "<unknown>", IP_STRING_LEN);
@ -364,7 +364,7 @@ char *string;
} break;
case EX_ROUTER_IP_v4: { // IPv4 router address
tpl_ext_23_t *tpl = (tpl_ext_23_t *)data_ptr;
tpl->router_ip = fs->ip.v4;
tpl->router_ip = fs->ip.V4;
data_ptr = (void *)tpl->data;
ClearFlag(common_record->flags, FLAG_IPV6_EXP);
} break;

16
bin/netflow_v5_v7.c
View File

@ -192,7 +192,7 @@ char ipstr[IP_STRING_LEN];
// search the appropriate exporter engine
while ( *e ) {
if ( (*e)->info.version == version && (*e)->info.id == engine_tag &&
(*e)->info.ip.v6[0] == fs->ip.v6[0] && (*e)->info.ip.v6[1] == fs->ip.v6[1])
(*e)->info.ip.V6[0] == fs->ip.V6[0] && (*e)->info.ip.V6[1] == fs->ip.V6[1])
return *e;
e = &((*e)->next);
}
@ -258,12 +258,12 @@ char ipstr[IP_STRING_LEN];
FlushInfoSampler(fs, &(sampler->info));
if ( fs->sa_family == AF_INET ) {
uint32_t _ip = htonl(fs->ip.v4);
uint32_t _ip = htonl(fs->ip.V4);
inet_ntop(AF_INET, &_ip, ipstr, sizeof(ipstr));
} else if ( fs->sa_family == AF_INET6 ) {
uint64_t _ip[2];
_ip[0] = htonll(fs->ip.v6[0]);
_ip[1] = htonll(fs->ip.v6[1]);
_ip[0] = htonll(fs->ip.V6[0]);
_ip[1] = htonll(fs->ip.V6[1]);
inet_ntop(AF_INET6, &_ip, ipstr, sizeof(ipstr));
} else {
strncpy(ipstr, "<unknown>", IP_STRING_LEN);
@ -493,7 +493,7 @@ char *string;
} break;
case EX_ROUTER_IP_v4: { // IPv4 router address
tpl_ext_23_t *tpl = (tpl_ext_23_t *)data_ptr;
tpl->router_ip = fs->ip.v4;
tpl->router_ip = fs->ip.V4;
data_ptr = (void *)tpl->data;
ClearFlag(common_record->flags, FLAG_IPV6_EXP);
} break;
@ -707,8 +707,8 @@ uint32_t i, id, t1, t2;
v5_output_record->First = htonl(t1);
v5_output_record->Last = htonl(t2);
v5_output_record->srcaddr = htonl(master_record->v4.srcaddr);
v5_output_record->dstaddr = htonl(master_record->v4.dstaddr);
v5_output_record->srcaddr = htonl(master_record->V4.srcaddr);
v5_output_record->dstaddr = htonl(master_record->V4.dstaddr);
v5_output_record->srcport = htons(master_record->srcport);
v5_output_record->dstport = htons(master_record->dstport);
@ -746,7 +746,7 @@ uint32_t i, id, t1, t2;
v5_output_record->dst_mask = master_record->dst_mask;
break;
case EX_NEXT_HOP_v4:
v5_output_record->nexthop = htonl(master_record->ip_nexthop.v4);
v5_output_record->nexthop = htonl(master_record->ip_nexthop.V4);
break;
// default: Other extensions can not be sent with v5
}

40
bin/netflow_v9.c
View File

@ -475,18 +475,18 @@ exporter_v9_domain_t **e = (exporter_v9_domain_t **)&(fs->exporter_data);
while ( *e ) {
if ( (*e)->info.id == exporter_id && (*e)->info.version == 9 &&
(*e)->info.ip.v6[0] == fs->ip.v6[0] && (*e)->info.ip.v6[1] == fs->ip.v6[1])
(*e)->info.ip.V6[0] == fs->ip.V6[0] && (*e)->info.ip.V6[1] == fs->ip.V6[1])
return *e;
e = &((*e)->next);
}
if ( fs->sa_family == AF_INET ) {
uint32_t _ip = htonl(fs->ip.v4);
uint32_t _ip = htonl(fs->ip.V4);
inet_ntop(AF_INET, &_ip, ipstr, sizeof(ipstr));
} else if ( fs->sa_family == AF_INET6 ) {
uint64_t _ip[2];
_ip[0] = htonll(fs->ip.v6[0]);
_ip[1] = htonll(fs->ip.v6[1]);
_ip[0] = htonll(fs->ip.V6[0]);
_ip[1] = htonll(fs->ip.V6[1]);
inet_ntop(AF_INET6, &_ip, ipstr, sizeof(ipstr));
} else {
strncpy(ipstr, "<unknown>", IP_STRING_LEN);
@ -1845,15 +1845,15 @@ char *string;
/* 64bit access to potentially unaligned output buffer. use 2 x 32bit for _LP64 CPUs */
type_mask_t t;
t.val.val64 = exporter->info.ip.v6[0];
t.val.val64 = exporter->info.ip.V6[0];
*((uint32_t *)&out[output_offset]) = t.val.val32[0];
*((uint32_t *)&out[output_offset+4]) = t.val.val32[1];
t.val.val64 = exporter->info.ip.v6[1];
t.val.val64 = exporter->info.ip.V6[1];
*((uint32_t *)&out[output_offset+8]) = t.val.val32[0];
*((uint32_t *)&out[output_offset+12]) = t.val.val32[1];
} else {
*((uint32_t *)&out[output_offset]) = exporter->info.ip.v4;
*((uint32_t *)&out[output_offset]) = exporter->info.ip.V4;
}
}
@ -2626,18 +2626,18 @@ uint16_t icmp;
// IP address info
if ((master_record->flags & FLAG_IPV6_ADDR) != 0 ) { // IPv6
master_record->v6.srcaddr[0] = htonll(master_record->v6.srcaddr[0]);
master_record->v6.srcaddr[1] = htonll(master_record->v6.srcaddr[1]);
master_record->v6.dstaddr[0] = htonll(master_record->v6.dstaddr[0]);
master_record->v6.dstaddr[1] = htonll(master_record->v6.dstaddr[1]);
master_record->V6.srcaddr[0] = htonll(master_record->V6.srcaddr[0]);
master_record->V6.srcaddr[1] = htonll(master_record->V6.srcaddr[1]);
master_record->V6.dstaddr[0] = htonll(master_record->V6.dstaddr[0]);
master_record->V6.dstaddr[1] = htonll(master_record->V6.dstaddr[1]);
// keep compiler happy
// memcpy(peer->buff_ptr, master_record->v6.srcaddr, 4 * sizeof(uint64_t));
// memcpy(peer->buff_ptr, master_record->V6.srcaddr, 4 * sizeof(uint64_t));
memcpy(peer->buff_ptr, master_record->ip_union._ip_64.addr, 4 * sizeof(uint64_t));
peer->buff_ptr = (void *)((pointer_addr_t)peer->buff_ptr + 4 * sizeof(uint64_t));
} else {
Put_val32(htonl(master_record->v4.srcaddr), peer->buff_ptr);
Put_val32(htonl(master_record->V4.srcaddr), peer->buff_ptr);
peer->buff_ptr = (void *)((pointer_addr_t)peer->buff_ptr + sizeof(uint32_t));
Put_val32(htonl(master_record->v4.dstaddr), peer->buff_ptr);
Put_val32(htonl(master_record->V4.dstaddr), peer->buff_ptr);
peer->buff_ptr = (void *)((pointer_addr_t)peer->buff_ptr + sizeof(uint32_t));
}
@ -2712,23 +2712,23 @@ uint16_t icmp;
peer->buff_ptr = (void *)tpl->data;
} break;
case EX_NEXT_HOP_v4:
Put_val32(htonl(master_record->ip_nexthop.v4), peer->buff_ptr);
Put_val32(htonl(master_record->ip_nexthop.V4), peer->buff_ptr);
peer->buff_ptr = (void *)((pointer_addr_t)peer->buff_ptr + sizeof(uint32_t));
break;
case EX_NEXT_HOP_v6:
Put_val64(htonll(master_record->ip_nexthop.v6[0]), peer->buff_ptr);
Put_val64(htonll(master_record->ip_nexthop.V6[0]), peer->buff_ptr);
peer->buff_ptr = (void *)((pointer_addr_t)peer->buff_ptr + sizeof(uint64_t));
Put_val64(htonll(master_record->ip_nexthop.v6[1]), peer->buff_ptr);
Put_val64(htonll(master_record->ip_nexthop.V6[1]), peer->buff_ptr);
peer->buff_ptr = (void *)((pointer_addr_t)peer->buff_ptr + sizeof(uint64_t));
break;
case EX_NEXT_HOP_BGP_v4:
Put_val32(htonl(master_record->bgp_nexthop.v4), peer->buff_ptr);
Put_val32(htonl(master_record->bgp_nexthop.V4), peer->buff_ptr);
peer->buff_ptr = (void *)((pointer_addr_t)peer->buff_ptr + sizeof(uint32_t));
break;
case EX_NEXT_HOP_BGP_v6:
Put_val64(htonll(master_record->bgp_nexthop.v6[0]), peer->buff_ptr);
Put_val64(htonll(master_record->bgp_nexthop.V6[0]), peer->buff_ptr);
peer->buff_ptr = (void *)((pointer_addr_t)peer->buff_ptr + sizeof(uint64_t));
Put_val64(htonll(master_record->bgp_nexthop.v6[1]), peer->buff_ptr);
Put_val64(htonll(master_record->bgp_nexthop.V6[1]), peer->buff_ptr);
peer->buff_ptr = (void *)((pointer_addr_t)peer->buff_ptr + sizeof(uint64_t));
break;
case EX_VLAN:

216
bin/nf_common.c
View File

@ -1,4 +1,5 @@
/*
* Copyright (c) 2017, Peter Haag
* Copyright (c) 2016, Peter Haag
* Copyright (c) 2014, Peter Haag
* Copyright (c) 2009, Peter Haag
@ -29,7 +30,6 @@
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
* POSSIBILITY OF SUCH DAMAGE.
*
*
*/
#include "config.h"
@ -684,16 +684,16 @@ extension_map_t *extension_map = r->map_ref;
uint64_t dnet[2];
// remember IPs for network
snet[0] = r->v6.srcaddr[0];
snet[1] = r->v6.srcaddr[1];
dnet[0] = r->v6.dstaddr[0];
dnet[1] = r->v6.dstaddr[1];
r->v6.srcaddr[0] = htonll(r->v6.srcaddr[0]);
r->v6.srcaddr[1] = htonll(r->v6.srcaddr[1]);
r->v6.dstaddr[0] = htonll(r->v6.dstaddr[0]);
r->v6.dstaddr[1] = htonll(r->v6.dstaddr[1]);
inet_ntop(AF_INET6, r->v6.srcaddr, as, sizeof(as));
inet_ntop(AF_INET6, r->v6.dstaddr, ds, sizeof(ds));
snet[0] = r->V6.srcaddr[0];
snet[1] = r->V6.srcaddr[1];
dnet[0] = r->V6.dstaddr[0];
dnet[1] = r->V6.dstaddr[1];
r->V6.srcaddr[0] = htonll(r->V6.srcaddr[0]);
r->V6.srcaddr[1] = htonll(r->V6.srcaddr[1]);
r->V6.dstaddr[0] = htonll(r->V6.dstaddr[0]);
r->V6.dstaddr[1] = htonll(r->V6.dstaddr[1]);
inet_ntop(AF_INET6, r->V6.srcaddr, as, sizeof(as));
inet_ntop(AF_INET6, r->V6.dstaddr, ds, sizeof(ds));
if ( ! long_v6 ) {
condense_v6(as);
condense_v6(ds);
@ -730,12 +730,12 @@ extension_map_t *extension_map = r->map_ref;
} else { // IPv4
uint32_t snet, dnet;
snet = r->v4.srcaddr;
dnet = r->v4.dstaddr;
r->v4.srcaddr = htonl(r->v4.srcaddr);
r->v4.dstaddr = htonl(r->v4.dstaddr);
inet_ntop(AF_INET, &r->v4.srcaddr, as, sizeof(as));
inet_ntop(AF_INET, &r->v4.dstaddr, ds, sizeof(ds));
snet = r->V4.srcaddr;
dnet = r->V4.dstaddr;
r->V4.srcaddr = htonl(r->V4.srcaddr);
r->V4.dstaddr = htonl(r->V4.dstaddr);
inet_ntop(AF_INET, &r->V4.srcaddr, as, sizeof(as));
inet_ntop(AF_INET, &r->V4.dstaddr, ds, sizeof(ds));
if ( r->src_mask || r->dst_mask) {
snet &= 0xffffffffL << ( 32 - r->src_mask );
snet = htonl(snet);
@ -866,8 +866,8 @@ extension_map_t *extension_map = r->map_ref;
break;
case EX_NEXT_HOP_v4:
as[0] = 0;
r->ip_nexthop.v4 = htonl(r->ip_nexthop.v4);
inet_ntop(AF_INET, &r->ip_nexthop.v4, as, sizeof(as));
r->ip_nexthop.V4 = htonl(r->ip_nexthop.V4);
inet_ntop(AF_INET, &r->ip_nexthop.V4, as, sizeof(as));
as[IP_STRING_LEN-1] = 0;
snprintf(_s, slen-1,
@ -880,9 +880,9 @@ extension_map_t *extension_map = r->map_ref;
break;
case EX_NEXT_HOP_v6:
as[0] = 0;
r->ip_nexthop.v6[0] = htonll(r->ip_nexthop.v6[0]);
r->ip_nexthop.v6[1] = htonll(r->ip_nexthop.v6[1]);
inet_ntop(AF_INET6, r->ip_nexthop.v6, as, sizeof(as));
r->ip_nexthop.V6[0] = htonll(r->ip_nexthop.V6[0]);
r->ip_nexthop.V6[1] = htonll(r->ip_nexthop.V6[1]);
inet_ntop(AF_INET6, r->ip_nexthop.V6, as, sizeof(as));
if ( ! long_v6 ) {
condense_v6(as);
condense_v6(ds);
@ -898,8 +898,8 @@ extension_map_t *extension_map = r->map_ref;
break;
case EX_NEXT_HOP_BGP_v4:
as[0] = 0;
r->bgp_nexthop.v4 = htonl(r->bgp_nexthop.v4);
inet_ntop(AF_INET, &r->bgp_nexthop.v4, as, sizeof(as));
r->bgp_nexthop.V4 = htonl(r->bgp_nexthop.V4);
inet_ntop(AF_INET, &r->bgp_nexthop.V4, as, sizeof(as));
as[IP_STRING_LEN-1] = 0;
snprintf(_s, slen-1,
@ -912,9 +912,9 @@ extension_map_t *extension_map = r->map_ref;
break;
case EX_NEXT_HOP_BGP_v6:
as[0] = 0;
r->bgp_nexthop.v6[0] = htonll(r->bgp_nexthop.v6[0]);
r->bgp_nexthop.v6[1] = htonll(r->bgp_nexthop.v6[1]);
inet_ntop(AF_INET6, r->ip_nexthop.v6, as, sizeof(as));
r->bgp_nexthop.V6[0] = htonll(r->bgp_nexthop.V6[0]);
r->bgp_nexthop.V6[1] = htonll(r->bgp_nexthop.V6[1]);
inet_ntop(AF_INET6, r->ip_nexthop.V6, as, sizeof(as));
if ( ! long_v6 ) {
condense_v6(as);
condense_v6(ds);
@ -1015,8 +1015,8 @@ extension_map_t *extension_map = r->map_ref;
} break;
case EX_ROUTER_IP_v4:
as[0] = 0;
r->ip_router.v4 = htonl(r->ip_router.v4);
inet_ntop(AF_INET, &r->ip_router.v4, as, sizeof(as));
r->ip_router.V4 = htonl(r->ip_router.V4);
inet_ntop(AF_INET, &r->ip_router.V4, as, sizeof(as));
as[IP_STRING_LEN-1] = 0;
snprintf(_s, slen-1,
@ -1029,9 +1029,9 @@ extension_map_t *extension_map = r->map_ref;
break;
case EX_ROUTER_IP_v6:
as[0] = 0;
r->ip_router.v6[0] = htonll(r->ip_router.v6[0]);
r->ip_router.v6[1] = htonll(r->ip_router.v6[1]);
inet_ntop(AF_INET6, &r->ip_router.v6, as, sizeof(as));
r->ip_router.V6[0] = htonll(r->ip_router.V6[0]);
r->ip_router.V6[1] = htonll(r->ip_router.V6[1]);
inet_ntop(AF_INET6, &r->ip_router.V6, as, sizeof(as));
if ( ! long_v6 ) {
condense_v6(as);
}
@ -1223,15 +1223,15 @@ master_record_t *r = (master_record_t *)record;
}
// Make sure Endian does not screw us up
sa[0] = ( r->v6.srcaddr[0] >> 32 ) & 0xffffffffLL;
sa[1] = r->v6.srcaddr[0] & 0xffffffffLL;
sa[2] = ( r->v6.srcaddr[1] >> 32 ) & 0xffffffffLL;
sa[3] = r->v6.srcaddr[1] & 0xffffffffLL;
sa[0] = ( r->V6.srcaddr[0] >> 32 ) & 0xffffffffLL;
sa[1] = r->V6.srcaddr[0] & 0xffffffffLL;
sa[2] = ( r->V6.srcaddr[1] >> 32 ) & 0xffffffffLL;
sa[3] = r->V6.srcaddr[1] & 0xffffffffLL;
da[0] = ( r->v6.dstaddr[0] >> 32 ) & 0xffffffffLL;
da[1] = r->v6.dstaddr[0] & 0xffffffffLL;
da[2] = ( r->v6.dstaddr[1] >> 32 ) & 0xffffffffLL;
da[3] = r->v6.dstaddr[1] & 0xffffffffLL;
da[0] = ( r->V6.dstaddr[0] >> 32 ) & 0xffffffffLL;
da[1] = r->V6.dstaddr[0] & 0xffffffffLL;
da[2] = ( r->V6.dstaddr[1] >> 32 ) & 0xffffffffLL;
da[3] = r->V6.dstaddr[1] & 0xffffffffLL;
snprintf(data_string, STRINGSIZE-1 ,"%i|%u|%u|%u|%u|%u|%u|%u|%u|%u|%u|%u|%u|%u|%u|%u|%u|%u|%u|%u|%u|%u|%llu|%llu",
af, r->first, r->msec_first ,r->last, r->msec_last, r->prot,
@ -1261,16 +1261,16 @@ master_record_t *r = (master_record_t *)record;
uint64_t dnet[2];
// remember IPs for network
snet[0] = r->v6.srcaddr[0];
snet[1] = r->v6.srcaddr[1];
dnet[0] = r->v6.dstaddr[0];
dnet[1] = r->v6.dstaddr[1];
r->v6.srcaddr[0] = htonll(r->v6.srcaddr[0]);
r->v6.srcaddr[1] = htonll(r->v6.srcaddr[1]);
r->v6.dstaddr[0] = htonll(r->v6.dstaddr[0]);
r->v6.dstaddr[1] = htonll(r->v6.dstaddr[1]);
inet_ntop(AF_INET6, r->v6.srcaddr, as, sizeof(as));
inet_ntop(AF_INET6, r->v6.dstaddr, ds, sizeof(ds));
snet[0] = r->V6.srcaddr[0];
snet[1] = r->V6.srcaddr[1];
dnet[0] = r->V6.dstaddr[0];
dnet[1] = r->V6.dstaddr[1];
r->V6.srcaddr[0] = htonll(r->V6.srcaddr[0]);
r->V6.srcaddr[1] = htonll(r->V6.srcaddr[1]);
r->V6.dstaddr[0] = htonll(r->V6.dstaddr[0]);
r->V6.dstaddr[1] = htonll(r->V6.dstaddr[1]);
inet_ntop(AF_INET6, r->V6.srcaddr, as, sizeof(as));
inet_ntop(AF_INET6, r->V6.dstaddr, ds, sizeof(ds));
if ( r->src_mask || r->dst_mask) {
if ( r->src_mask > 64 )
@ -1300,12 +1300,12 @@ master_record_t *r = (master_record_t *)record;
} else { // IPv4
uint32_t snet, dnet;
snet = r->v4.srcaddr;
dnet = r->v4.dstaddr;
r->v4.srcaddr = htonl(r->v4.srcaddr);
r->v4.dstaddr = htonl(r->v4.dstaddr);
inet_ntop(AF_INET, &r->v4.srcaddr, as, sizeof(as));
inet_ntop(AF_INET, &r->v4.dstaddr, ds, sizeof(ds));
snet = r->V4.srcaddr;
dnet = r->V4.dstaddr;
r->V4.srcaddr = htonl(r->V4.srcaddr);
r->V4.dstaddr = htonl(r->V4.dstaddr);
inet_ntop(AF_INET, &r->V4.srcaddr, as, sizeof(as));
inet_ntop(AF_INET, &r->V4.dstaddr, ds, sizeof(ds));
if ( r->src_mask || r->dst_mask) {
snet &= 0xffffffffL << ( 32 - r->src_mask );
snet = htonl(snet);
@ -1384,9 +1384,9 @@ master_record_t *r = (master_record_t *)record;
if ( (r->flags & FLAG_IPV6_NH ) != 0 ) { // IPv6
// EX_NEXT_HOP_v6:
as[0] = 0;
r->ip_nexthop.v6[0] = htonll(r->ip_nexthop.v6[0]);
r->ip_nexthop.v6[1] = htonll(r->ip_nexthop.v6[1]);
inet_ntop(AF_INET6, r->ip_nexthop.v6, as, sizeof(as));
r->ip_nexthop.V6[0] = htonll(r->ip_nexthop.V6[0]);
r->ip_nexthop.V6[1] = htonll(r->ip_nexthop.V6[1]);
inet_ntop(AF_INET6, r->ip_nexthop.V6, as, sizeof(as));
as[IP_STRING_LEN-1] = 0;
snprintf(_s, slen-1, ",%s", as);
@ -1397,8 +1397,8 @@ master_record_t *r = (master_record_t *)record;
} else {
// EX_NEXT_HOP_v4:
as[0] = 0;
r->ip_nexthop.v4 = htonl(r->ip_nexthop.v4);
inet_ntop(AF_INET, &r->ip_nexthop.v4, as, sizeof(as));
r->ip_nexthop.V4 = htonl(r->ip_nexthop.V4);
inet_ntop(AF_INET, &r->ip_nexthop.V4, as, sizeof(as));
as[IP_STRING_LEN-1] = 0;
snprintf(_s, slen-1, ",%s", as);
@ -1410,9 +1410,9 @@ master_record_t *r = (master_record_t *)record;
if ( (r->flags & FLAG_IPV6_NH ) != 0 ) { // IPv6
// EX_NEXT_HOP_BGP_v6:
as[0] = 0;
r->bgp_nexthop.v6[0] = htonll(r->bgp_nexthop.v6[0]);
r->bgp_nexthop.v6[1] = htonll(r->bgp_nexthop.v6[1]);
inet_ntop(AF_INET6, r->ip_nexthop.v6, as, sizeof(as));
r->bgp_nexthop.V6[0] = htonll(r->bgp_nexthop.V6[0]);
r->bgp_nexthop.V6[1] = htonll(r->bgp_nexthop.V6[1]);
inet_ntop(AF_INET6, r->ip_nexthop.V6, as, sizeof(as));
as[IP_STRING_LEN-1] = 0;
snprintf(_s, slen-1, ",%s", as);
@ -1423,8 +1423,8 @@ master_record_t *r = (master_record_t *)record;
} else {
// EX_NEXT_HOP_BGP_v4:
as[0] = 0;
r->bgp_nexthop.v4 = htonl(r->bgp_nexthop.v4);
inet_ntop(AF_INET, &r->bgp_nexthop.v4, as, sizeof(as));
r->bgp_nexthop.V4 = htonl(r->bgp_nexthop.V4);
inet_ntop(AF_INET, &r->bgp_nexthop.V4, as, sizeof(as));
as[IP_STRING_LEN-1] = 0;
snprintf(_s, slen-1, ",%s", as);
@ -1519,9 +1519,9 @@ master_record_t *r = (master_record_t *)record;
if ( (r->flags & FLAG_IPV6_EXP ) != 0 ) { // IPv6
// EX_NEXT_HOP_v6:
as[0] = 0;
r->ip_router.v6[0] = htonll(r->ip_router.v6[0]);
r->ip_router.v6[1] = htonll(r->ip_router.v6[1]);
inet_ntop(AF_INET6, r->ip_router.v6, as, sizeof(as));
r->ip_router.V6[0] = htonll(r->ip_router.V6[0]);
r->ip_router.V6[1] = htonll(r->ip_router.V6[1]);
inet_ntop(AF_INET6, r->ip_router.V6, as, sizeof(as));
as[IP_STRING_LEN-1] = 0;
snprintf(_s, slen-1, ",%s", as);
@ -1532,8 +1532,8 @@ master_record_t *r = (master_record_t *)record;
} else {
// EX_NEXT_HOP_v4:
as[0] = 0;
r->ip_router.v4 = htonl(r->ip_router.v4);
inet_ntop(AF_INET, &r->ip_router.v4, as, sizeof(as));
r->ip_router.V4 = htonl(r->ip_router.V4);
inet_ntop(AF_INET, &r->ip_router.V4, as, sizeof(as));
as[IP_STRING_LEN-1] = 0;
snprintf(_s, slen-1, ",%s", as);
@ -1927,15 +1927,15 @@ char tmp_str[IP_STRING_LEN];
if ( (r->flags & FLAG_IPV6_ADDR ) != 0 ) { // IPv6
uint64_t ip[2];
ip[0] = htonll(r->v6.srcaddr[0]);
ip[1] = htonll(r->v6.srcaddr[1]);
ip[0] = htonll(r->V6.srcaddr[0]);
ip[1] = htonll(r->V6.srcaddr[1]);
inet_ntop(AF_INET6, ip, tmp_str, sizeof(tmp_str));
if ( ! long_v6 ) {
condense_v6(tmp_str);
}
} else { // IPv4
uint32_t ip;
ip = htonl(r->v4.srcaddr);
ip = htonl(r->V4.srcaddr);
inet_ntop(AF_INET, &ip, tmp_str, sizeof(tmp_str));
}
tmp_str[IP_STRING_LEN-1] = 0;
@ -1956,8 +1956,8 @@ char tmp_str[IP_STRING_LEN], portchar;
if ( (r->flags & FLAG_IPV6_ADDR ) != 0 ) { // IPv6
uint64_t ip[2];
ip[0] = htonll(r->v6.srcaddr[0]);
ip[1] = htonll(r->v6.srcaddr[1]);
ip[0] = htonll(r->V6.srcaddr[0]);
ip[1] = htonll(r->V6.srcaddr[1]);
inet_ntop(AF_INET6, ip, tmp_str, sizeof(tmp_str));
if ( ! long_v6 ) {
condense_v6(tmp_str);
@ -1965,7 +1965,7 @@ char tmp_str[IP_STRING_LEN], portchar;
portchar = '.';
} else { // IPv4
uint32_t ip;
ip = htonl(r->v4.srcaddr);
ip = htonl(r->V4.srcaddr);
inet_ntop(AF_INET, &ip, tmp_str, sizeof(tmp_str));
portchar = ':';
}
@ -1987,15 +1987,15 @@ char tmp_str[IP_STRING_LEN];
if ( (r->flags & FLAG_IPV6_ADDR ) != 0 ) { // IPv6
uint64_t ip[2];
ip[0] = htonll(r->v6.dstaddr[0]);
ip[1] = htonll(r->v6.dstaddr[1]);
ip[0] = htonll(r->V6.dstaddr[0]);
ip[1] = htonll(r->V6.dstaddr[1]);
inet_ntop(AF_INET6, ip, tmp_str, sizeof(tmp_str));
if ( ! long_v6 ) {
condense_v6(tmp_str);
}
} else { // IPv4
uint32_t ip;
ip = htonl(r->v4.dstaddr);
ip = htonl(r->V4.dstaddr);
inet_ntop(AF_INET, &ip, tmp_str, sizeof(tmp_str));
}
tmp_str[IP_STRING_LEN-1] = 0;
@ -2017,15 +2017,15 @@ char tmp_str[IP_STRING_LEN];
if ( (r->flags & FLAG_IPV6_NH ) != 0 ) { // IPv6
uint64_t ip[2];
ip[0] = htonll(r->ip_nexthop.v6[0]);
ip[1] = htonll(r->ip_nexthop.v6[1]);
ip[0] = htonll(r->ip_nexthop.V6[0]);
ip[1] = htonll(r->ip_nexthop.V6[1]);
inet_ntop(AF_INET6, ip, tmp_str, sizeof(tmp_str));
if ( ! long_v6 ) {
condense_v6(tmp_str);
}
} else { // IPv4
uint32_t ip;
ip = htonl(r->ip_nexthop.v4);
ip = htonl(r->ip_nexthop.V4);
inet_ntop(AF_INET, &ip, tmp_str, sizeof(tmp_str));
}
tmp_str[IP_STRING_LEN-1] = 0;
@ -2046,15 +2046,15 @@ char tmp_str[IP_STRING_LEN];
if ( (r->flags & FLAG_IPV6_NH ) != 0 ) { // IPv6
uint64_t ip[2];
ip[0] = htonll(r->bgp_nexthop.v6[0]);
ip[1] = htonll(r->bgp_nexthop.v6[1]);
ip[0] = htonll(r->bgp_nexthop.V6[0]);
ip[1] = htonll(r->bgp_nexthop.V6[1]);
inet_ntop(AF_INET6, ip, tmp_str, sizeof(tmp_str));
if ( ! long_v6 ) {
condense_v6(tmp_str);
}
} else { // IPv4
uint32_t ip;
ip = htonl(r->bgp_nexthop.v4);
ip = htonl(r->bgp_nexthop.V4);
inet_ntop(AF_INET, &ip, tmp_str, sizeof(tmp_str));
}
tmp_str[IP_STRING_LEN-1] = 0;
@ -2075,15 +2075,15 @@ char tmp_str[IP_STRING_LEN];
if ( (r->flags & FLAG_IPV6_EXP ) != 0 ) { // IPv6
uint64_t ip[2];
ip[0] = htonll(r->ip_router.v6[0]);
ip[1] = htonll(r->ip_router.v6[1]);
ip[0] = htonll(r->ip_router.V6[0]);
ip[1] = htonll(r->ip_router.V6[1]);
inet_ntop(AF_INET6, ip, tmp_str, sizeof(tmp_str));
if ( ! long_v6 ) {
condense_v6(tmp_str);
}
} else { // IPv4
uint32_t ip;
ip = htonl(r->ip_router.v4);
ip = htonl(r->ip_router.V4);
inet_ntop(AF_INET, &ip, tmp_str, sizeof(tmp_str));
}
tmp_str[IP_STRING_LEN-1] = 0;
@ -2106,8 +2106,8 @@ char icmp_port[MAX_STRING_LENGTH];
if ( (r->flags & FLAG_IPV6_ADDR ) != 0 ) { // IPv6
uint64_t ip[2];
ip[0] = htonll(r->v6.dstaddr[0]);
ip[1] = htonll(r->v6.dstaddr[1]);
ip[0] = htonll(r->V6.dstaddr[0]);
ip[1] = htonll(r->V6.dstaddr[1]);
inet_ntop(AF_INET6, ip, tmp_str, sizeof(tmp_str));
if ( ! long_v6 ) {
condense_v6(tmp_str);
@ -2115,7 +2115,7 @@ char icmp_port[MAX_STRING_LENGTH];
portchar = '.';
} else { // IPv4
uint32_t ip;
ip = htonl(r->v4.dstaddr);
ip = htonl(r->V4.dstaddr);
inet_ntop(AF_INET, &ip, tmp_str, sizeof(tmp_str));
portchar = ':';
}
@ -2140,15 +2140,15 @@ char tmp_str[IP_STRING_LEN];
if ( (r->flags & FLAG_IPV6_ADDR ) != 0 ) { // IPv6
uint64_t ip[2];
ip[0] = htonll(r->v6.srcaddr[0]);
ip[1] = htonll(r->v6.srcaddr[1]);
ip[0] = htonll(r->V6.srcaddr[0]);
ip[1] = htonll(r->V6.srcaddr[1]);
inet_ntop(AF_INET6, ip, tmp_str, sizeof(tmp_str));
if ( ! long_v6 ) {
condense_v6(tmp_str);
}
} else { // IPv4
uint32_t ip;
ip = htonl(r->v4.srcaddr);
ip = htonl(r->V4.srcaddr);
inet_ntop(AF_INET, &ip, tmp_str, sizeof(tmp_str));
}
tmp_str[IP_STRING_LEN-1] = 0;
@ -2171,15 +2171,15 @@ char tmp_str[IP_STRING_LEN];
if ( (r->flags & FLAG_IPV6_ADDR ) != 0 ) { // IPv6
uint64_t ip[2];
ip[0] = htonll(r->v6.dstaddr[0]);
ip[1] = htonll(r->v6.dstaddr[1]);
ip[0] = htonll(r->V6.dstaddr[0]);
ip[1] = htonll(r->V6.dstaddr[1]);
inet_ntop(AF_INET6, ip, tmp_str, sizeof(tmp_str));
if ( ! long_v6 ) {
condense_v6(tmp_str);
}
} else { // IPv4
uint32_t ip;
ip = htonl(r->v4.dstaddr);
ip = htonl(r->V4.dstaddr);
inet_ntop(AF_INET, &ip, tmp_str, sizeof(tmp_str));
}
tmp_str[IP_STRING_LEN-1] = 0;
@ -2737,15 +2737,15 @@ char tmp_str[IP_STRING_LEN];
if ( (r->xlate_flags & 1 ) != 0 ) { // IPv6
uint64_t ip[2];
ip[0] = htonll(r->xlate_src_ip.v6[0]);
ip[1] = htonll(r->xlate_src_ip.v6[1]);
ip[0] = htonll(r->xlate_src_ip.V6[0]);
ip[1] = htonll(r->xlate_src_ip.V6[1]);
inet_ntop(AF_INET6, ip, tmp_str, sizeof(tmp_str));
if ( ! long_v6 ) {
condense_v6(tmp_str);
}
} else { // IPv4
uint32_t ip;
ip = htonl(r->xlate_src_ip.v4);
ip = htonl(r->xlate_src_ip.V4);
inet_ntop(AF_INET, &ip, tmp_str, sizeof(tmp_str));
}
tmp_str[IP_STRING_LEN-1] = 0;
@ -2765,15 +2765,15 @@ char tmp_str[IP_STRING_LEN];
if ( (r->xlate_flags & 1 ) != 0 ) { // IPv6
uint64_t ip[2];
ip[0] = htonll(r->xlate_dst_ip.v6[0]);
ip[1] = htonll(r->xlate_dst_ip.v6[1]);
ip[0] = htonll(r->xlate_dst_ip.V6[0]);
ip[1] = htonll(r->xlate_dst_ip.V6[1]);
inet_ntop(AF_INET6, ip, tmp_str, sizeof(tmp_str));
if ( ! long_v6 ) {
condense_v6(tmp_str);
}
} else { // IPv4
uint32_t ip;
ip = htonl(r->xlate_dst_ip.v4);
ip = htonl(r->xlate_dst_ip.V4);
inet_ntop(AF_INET, &ip, tmp_str, sizeof(tmp_str));
}
tmp_str[IP_STRING_LEN-1] = 0;
@ -2807,8 +2807,8 @@ char tmp_str[IP_STRING_LEN], portchar;
if ( (r->xlate_flags & 1 ) != 0 ) { // IPv6
uint64_t ip[2];
ip[0] = htonll(r->xlate_src_ip.v6[0]);
ip[1] = htonll(r->xlate_src_ip.v6[1]);
ip[0] = htonll(r->xlate_src_ip.V6[0]);
ip[1] = htonll(r->xlate_src_ip.V6[1]);
inet_ntop(AF_INET6, ip, tmp_str, sizeof(tmp_str));
if ( ! long_v6 ) {
condense_v6(tmp_str);
@ -2817,7 +2817,7 @@ char tmp_str[IP_STRING_LEN], portchar;
portchar = '.';
} else { // IPv4
uint32_t ip;
ip = htonl(r->xlate_src_ip.v4);
ip = htonl(r->xlate_src_ip.V4);
inet_ntop(AF_INET, &ip, tmp_str, sizeof(tmp_str));
portchar = ':';
@ -2850,7 +2850,7 @@ char tmp_str[IP_STRING_LEN], portchar;
portchar = '.';
} else { // IPv4
uint32_t ip;
ip = htonl(r->xlate_dst_ip.v4);
ip = htonl(r->xlate_dst_ip.V4);
inet_ntop(AF_INET, &ip, tmp_str, sizeof(tmp_str));
portchar = ':';

64
bin/nfanon.c
View File

@ -1,4 +1,5 @@
/*
* Copyright (c) 2017, Peter Haag
* Copyright (c) 2014, Peter Haag
* Copyright (c) 2009, Peter Haag
* Copyright (c) 2004-2008, SWITCH - Teleinformatikdienste fuer Lehre und Forschung
@ -28,13 +29,6 @@
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
* POSSIBILITY OF SUCH DAMAGE.
*
* $Author: haag $
*
* $Id:$
*
* $LastChangedRevision: 48 $
*
*
*/
#include "config.h"
@ -106,18 +100,18 @@ int i;
if ( (master_record->flags & FLAG_IPV6_ADDR) != 0 ) { // IPv6
// IPv6
uint64_t anon_ip[2];
anonymize_v6(master_record->v6.srcaddr, anon_ip);
master_record->v6.srcaddr[0] = anon_ip[0];
master_record->v6.srcaddr[1] = anon_ip[1];
anonymize_v6(master_record->V6.srcaddr, anon_ip);
master_record->V6.srcaddr[0] = anon_ip[0];
master_record->V6.srcaddr[1] = anon_ip[1];
anonymize_v6(master_record->v6.dstaddr, anon_ip);
master_record->v6.dstaddr[0] = anon_ip[0];
master_record->v6.dstaddr[1] = anon_ip[1];
anonymize_v6(master_record->V6.dstaddr, anon_ip);
master_record->V6.dstaddr[0] = anon_ip[0];
master_record->V6.dstaddr[1] = anon_ip[1];
} else {
// IPv4
master_record->v4.srcaddr = anonymize(master_record->v4.srcaddr);
master_record->v4.dstaddr = anonymize(master_record->v4.dstaddr);
master_record->V4.srcaddr = anonymize(master_record->V4.srcaddr);
master_record->V4.dstaddr = anonymize(master_record->V4.dstaddr);
}
// Process optional extensions
@ -133,45 +127,45 @@ int i;
master_record->dstas = 0;
break;
case EX_NEXT_HOP_v4:
master_record->ip_nexthop.v4 = anonymize(master_record->ip_nexthop.v4);
master_record->ip_nexthop.V4 = anonymize(master_record->ip_nexthop.V4);
break;
case EX_NEXT_HOP_v6: {
uint64_t anon_ip[2];
anonymize_v6(master_record->ip_nexthop.v6, anon_ip);
master_record->ip_nexthop.v6[0] = anon_ip[0];
master_record->ip_nexthop.v6[1] = anon_ip[1];
anonymize_v6(master_record->ip_nexthop.V6, anon_ip);
master_record->ip_nexthop.V6[0] = anon_ip[0];
master_record->ip_nexthop.V6[1] = anon_ip[1];
} break;
case EX_NEXT_HOP_BGP_v4:
master_record->bgp_nexthop.v4 = anonymize(master_record->bgp_nexthop.v4);
master_record->bgp_nexthop.V4 = anonymize(master_record->bgp_nexthop.V4);
break;
case EX_NEXT_HOP_BGP_v6: {
uint64_t anon_ip[2];
anonymize_v6(master_record->bgp_nexthop.v6, anon_ip);
master_record->bgp_nexthop.v6[0] = anon_ip[0];
master_record->bgp_nexthop.v6[1] = anon_ip[1];
anonymize_v6(master_record->bgp_nexthop.V6, anon_ip);
master_record->bgp_nexthop.V6[0] = anon_ip[0];
master_record->bgp_nexthop.V6[1] = anon_ip[1];
} break;
case EX_ROUTER_IP_v4:
master_record->ip_router.v4 = anonymize(master_record->ip_router.v4);
master_record->ip_router.V4 = anonymize(master_record->ip_router.V4);
break;
case EX_ROUTER_IP_v6: {
uint64_t anon_ip[2];
anonymize_v6(master_record->ip_router.v6, anon_ip);
master_record->ip_router.v6[0] = anon_ip[0];
master_record->ip_router.v6[1] = anon_ip[1];
anonymize_v6(master_record->ip_router.V6, anon_ip);
master_record->ip_router.V6[0] = anon_ip[0];
master_record->ip_router.V6[1] = anon_ip[1];
} break;
#ifdef NSEL
case EX_NSEL_XLATE_IP_v4:
master_record->xlate_src_ip.v4 = anonymize(master_record->xlate_src_ip.v4);
master_record->xlate_dst_ip.v4 = anonymize(master_record->xlate_dst_ip.v4);
master_record->xlate_src_ip.V4 = anonymize(master_record->xlate_src_ip.V4);
master_record->xlate_dst_ip.V4 = anonymize(master_record->xlate_dst_ip.V4);
break;
case EX_NSEL_XLATE_IP_v6: {
uint64_t anon_ip[2];
anonymize_v6(master_record->xlate_src_ip.v6, anon_ip);
master_record->xlate_src_ip.v6[0] = anon_ip[0];
master_record->xlate_src_ip.v6[1] = anon_ip[1];
anonymize_v6(master_record->xlate_dst_ip.v6, anon_ip);
master_record->xlate_dst_ip.v6[0] = anon_ip[0];
master_record->xlate_dst_ip.v6[1] = anon_ip[1];
anonymize_v6(master_record->xlate_src_ip.V6, anon_ip);
master_record->xlate_src_ip.V6[0] = anon_ip[0];
master_record->xlate_src_ip.V6[1] = anon_ip[1];
anonymize_v6(master_record->xlate_dst_ip.V6, anon_ip);
master_record->xlate_dst_ip.V6[0] = anon_ip[0];
master_record->xlate_dst_ip.V6[1] = anon_ip[1];
} break;
#endif
}

22
bin/nfexport.c
View File

@ -29,12 +29,6 @@
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
* POSSIBILITY OF SUCH DAMAGE.
*
* $Author: haag $
*
* $Id: nfexport.c 54 2010-01-29 11:30:22Z haag $
*
* $LastChangedRevision: 54 $
*
*/
#include "config.h"
@ -321,10 +315,10 @@ char *string;
// apply IP mask from aggregation, to provide a pretty output
if ( FlowTable->has_masks ) {
flow_record->v6.srcaddr[0] &= FlowTable->IPmask[0];
flow_record->v6.srcaddr[1] &= FlowTable->IPmask[1];
flow_record->v6.dstaddr[0] &= FlowTable->IPmask[2];
flow_record->v6.dstaddr[1] &= FlowTable->IPmask[3];
flow_record->V6.srcaddr[0] &= FlowTable->IPmask[0];
flow_record->V6.srcaddr[1] &= FlowTable->IPmask[1];
flow_record->V6.dstaddr[0] &= FlowTable->IPmask[2];
flow_record->V6.dstaddr[1] &= FlowTable->IPmask[3];
}
if ( FlowTable->apply_netbits )
@ -368,10 +362,10 @@ char *string;
// apply IP mask from aggregation, to provide a pretty output
if ( FlowTable->has_masks ) {
flow_record->v6.srcaddr[0] &= FlowTable->IPmask[0];
flow_record->v6.srcaddr[1] &= FlowTable->IPmask[1];
flow_record->v6.dstaddr[0] &= FlowTable->IPmask[2];
flow_record->v6.dstaddr[1] &= FlowTable->IPmask[3];
flow_record->V6.srcaddr[0] &= FlowTable->IPmask[0];
flow_record->V6.srcaddr[1] &= FlowTable->IPmask[1];
flow_record->V6.dstaddr[0] &= FlowTable->IPmask[2];
flow_record->V6.dstaddr[1] &= FlowTable->IPmask[3];
}
if ( FlowTable->apply_netbits )

14
bin/nffile.c
View File

@ -1213,19 +1213,19 @@ void *p = (void *)input_record;
if ( (input_record->flags & FLAG_IPV6_ADDR) != 0 ) { // IPv6
// IPv6
// keep compiler happy
// memcpy((void *)output_record->v6.srcaddr, p, 4 * sizeof(uint64_t));
// memcpy((void *)output_record->V6.srcaddr, p, 4 * sizeof(uint64_t));
memcpy((void *)output_record->ip_union._ip_64.addr, p, 4 * sizeof(uint64_t));
p = (void *)((pointer_addr_t)p + 4 * sizeof(uint64_t));
} else {
// IPv4
u = (uint32_t *)p;
output_record->v6.srcaddr[0] = 0;
output_record->v6.srcaddr[1] = 0;
output_record->v4.srcaddr = u[0];
output_record->V6.srcaddr[0] = 0;
output_record->V6.srcaddr[1] = 0;
output_record->V4.srcaddr = u[0];
output_record->v6.dstaddr[0] = 0;
output_record->v6.dstaddr[1] = 0;
output_record->v4.dstaddr = u[1];
output_record->V6.dstaddr[0] = 0;
output_record->V6.dstaddr[1] = 0;
output_record->V4.dstaddr = u[1];
p = (void *)((pointer_addr_t)p + 2 * sizeof(uint32_t));
}

13
bin/nffile.h
View File

@ -29,12 +29,6 @@
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
* POSSIBILITY OF SUCH DAMAGE.
*
* $Author: haag $
*
* $Id: nffile.h 40 2009-12-16 10:41:44Z haag $
*
* $LastChangedRevision: 40 $
*
*/
#ifndef _NFFILE_H
@ -345,7 +339,7 @@ typedef struct nffile_s {
* +----+--------------+--------------+--------------+--------------+--------------+--------------+--------------+--------------+
* | 2 | last (21) |fwd_status(89)| tcpflags (6) | proto (4) | src tos (5) |
* +----+--------------+--------------+--------------+--------------+--------------+--------------+--------------+--------------+
* | 3 | srcport (7) | dstport(11)/ICMP (32) | exporter ID | <free> |
* | 3 | srcport (7) | dstport(11)/ICMP (32) | exporter ID | reserved icmp type/code |
* +----+--------------+--------------+--------------+--------------+--------------+--------------+--------------+--------------+
*
@ -494,8 +488,8 @@ typedef struct ip_addr_s {
#define IP_ADDR_T
} ip_addr_t;
#define v4 ip_union._v4
#define v6 ip_union._v6
#define V4 ip_union._v4
#define V6 ip_union._v6
/*
* Extension 2:
@ -1505,7 +1499,6 @@ typedef struct master_record_s {
uint16_t icmp;
};
#ifdef WORDS_BIGENDIAN
# define OffsetPort 3
# define OffsetExporterSysID 3

107
bin/nffile_inline.c
View File

@ -1,4 +1,5 @@
/*
* Copyright (c) 2017, Peter Haag
* Copyright (c) 2016, Peter Haag
* Copyright (c) 2014, Peter Haag
* Copyright (c) 2009, Peter Haag
@ -134,19 +135,19 @@ void *p = (void *)input_record;
if ( (input_record->flags & FLAG_IPV6_ADDR) != 0 ) { // IPv6
// IPv6
// keep compiler happy
// memcpy((void *)output_record->v6.srcaddr, p, 4 * sizeof(uint64_t));
// memcpy((void *)output_record->V6.srcaddr, p, 4 * sizeof(uint64_t));
memcpy((void *)output_record->ip_union._ip_64.addr, p, 4 * sizeof(uint64_t));
p = (void *)((pointer_addr_t)p + 4 * sizeof(uint64_t));
} else {
// IPv4
u = (uint32_t *)p;
output_record->v6.srcaddr[0] = 0;
output_record->v6.srcaddr[1] = 0;
output_record->v4.srcaddr = u[0];
output_record->V6.srcaddr[0] = 0;
output_record->V6.srcaddr[1] = 0;
output_record->V4.srcaddr = u[0];
output_record->v6.dstaddr[0] = 0;
output_record->v6.dstaddr[1] = 0;
output_record->v4.dstaddr = u[1];
output_record->V6.dstaddr[0] = 0;
output_record->V6.dstaddr[1] = 0;
output_record->V4.dstaddr = u[1];
p = (void *)((pointer_addr_t)p + 2 * sizeof(uint32_t));
}
@ -223,29 +224,29 @@ void *p = (void *)input_record;
} break;
case EX_NEXT_HOP_v4: {
tpl_ext_9_t *tpl = (tpl_ext_9_t *)p;
output_record->ip_nexthop.v6[0] = 0;
output_record->ip_nexthop.v6[1] = 0;
output_record->ip_nexthop.v4 = tpl->nexthop;
output_record->ip_nexthop.V6[0] = 0;
output_record->ip_nexthop.V6[1] = 0;
output_record->ip_nexthop.V4 = tpl->nexthop;
p = (void *)tpl->data;
ClearFlag(output_record->flags, FLAG_IPV6_NH);
} break;
case EX_NEXT_HOP_v6: {
tpl_ext_10_t *tpl = (tpl_ext_10_t *)p;
CopyV6IP((uint32_t *)output_record->ip_nexthop.v6, (uint32_t *)tpl->nexthop);
CopyV6IP((uint32_t *)output_record->ip_nexthop.V6, (uint32_t *)tpl->nexthop);
p = (void *)tpl->data;
SetFlag(output_record->flags, FLAG_IPV6_NH);
} break;
case EX_NEXT_HOP_BGP_v4: {
tpl_ext_11_t *tpl = (tpl_ext_11_t *)p;
output_record->bgp_nexthop.v6[0] = 0;
output_record->bgp_nexthop.v6[1] = 0;
output_record->bgp_nexthop.v4 = tpl->bgp_nexthop;
output_record->bgp_nexthop.V6[0] = 0;
output_record->bgp_nexthop.V6[1] = 0;
output_record->bgp_nexthop.V4 = tpl->bgp_nexthop;
ClearFlag(output_record->flags, FLAG_IPV6_NHB);
p = (void *)tpl->data;
} break;
case EX_NEXT_HOP_BGP_v6: {
tpl_ext_12_t *tpl = (tpl_ext_12_t *)p;
CopyV6IP((uint32_t *)output_record->bgp_nexthop.v6, (uint32_t *)tpl->bgp_nexthop);
CopyV6IP((uint32_t *)output_record->bgp_nexthop.V6, (uint32_t *)tpl->bgp_nexthop);
p = (void *)tpl->data;
SetFlag(output_record->flags, FLAG_IPV6_NHB);
} break;
@ -322,15 +323,15 @@ void *p = (void *)input_record;
} break;
case EX_ROUTER_IP_v4: {
tpl_ext_23_t *tpl = (tpl_ext_23_t *)p;
output_record->ip_router.v6[0] = 0;
output_record->ip_router.v6[1] = 0;
output_record->ip_router.v4 = tpl->router_ip;
output_record->ip_router.V6[0] = 0;
output_record->ip_router.V6[1] = 0;
output_record->ip_router.V4 = tpl->router_ip;
p = (void *)tpl->data;
ClearFlag(output_record->flags, FLAG_IPV6_EXP);
} break;
case EX_ROUTER_IP_v6: {
tpl_ext_24_t *tpl = (tpl_ext_24_t *)p;
CopyV6IP((uint32_t *)output_record->ip_router.v6, (uint32_t *)tpl->router_ip);
CopyV6IP((uint32_t *)output_record->ip_router.V6, (uint32_t *)tpl->router_ip);
p = (void *)tpl->data;
SetFlag(output_record->flags, FLAG_IPV6_EXP);
} break;
@ -383,21 +384,21 @@ void *p = (void *)input_record;
} break;
case EX_NSEL_XLATE_IP_v4: {
tpl_ext_39_t *tpl = (tpl_ext_39_t *)p;
output_record->xlate_src_ip.v6[0] = 0;
output_record->xlate_src_ip.v6[1] = 0;
output_record->xlate_src_ip.v4 = tpl->xlate_src_ip;
output_record->xlate_dst_ip.v6[0] = 0;
output_record->xlate_dst_ip.v6[1] = 0;
output_record->xlate_dst_ip.v4 = tpl->xlate_dst_ip;
output_record->xlate_src_ip.V6[0] = 0;
output_record->xlate_src_ip.V6[1] = 0;
output_record->xlate_src_ip.V4 = tpl->xlate_src_ip;
output_record->xlate_dst_ip.V6[0] = 0;
output_record->xlate_dst_ip.V6[1] = 0;
output_record->xlate_dst_ip.V4 = tpl->xlate_dst_ip;
p = (void *)tpl->data;
output_record->xlate_flags = 0;
} break;
case EX_NSEL_XLATE_IP_v6: {
tpl_ext_40_t *tpl = (tpl_ext_40_t *)p;
output_record->xlate_src_ip.v6[0] = tpl->xlate_src_ip[0];
output_record->xlate_src_ip.v6[1] = tpl->xlate_src_ip[1];
output_record->xlate_dst_ip.v6[0] = tpl->xlate_dst_ip[0];
output_record->xlate_dst_ip.v6[1] = tpl->xlate_dst_ip[1];
output_record->xlate_src_ip.V6[0] = tpl->xlate_src_ip[0];
output_record->xlate_src_ip.V6[1] = tpl->xlate_src_ip[1];
output_record->xlate_dst_ip.V6[0] = tpl->xlate_dst_ip[0];
output_record->xlate_dst_ip.V6[1] = tpl->xlate_dst_ip[1];
p = (void *)tpl->data;
output_record->xlate_flags = 1;
} break;
@ -442,12 +443,12 @@ void *p = (void *)input_record;
// compat record v1.6.10
case EX_NEL_GLOBAL_IP_v4: {
tpl_ext_47_t *tpl = (tpl_ext_47_t *)p;
output_record->xlate_src_ip.v6[0] = 0;
output_record->xlate_src_ip.v6[1] = 0;
output_record->xlate_src_ip.v4 = tpl->nat_inside;
output_record->xlate_dst_ip.v6[0] = 0;
output_record->xlate_dst_ip.v6[1] = 0;
output_record->xlate_dst_ip.v4 = tpl->nat_outside;
output_record->xlate_src_ip.V6[0] = 0;
output_record->xlate_src_ip.V6[1] = 0;
output_record->xlate_src_ip.V4 = tpl->nat_inside;
output_record->xlate_dst_ip.V6[0] = 0;
output_record->xlate_dst_ip.V6[1] = 0;
output_record->xlate_dst_ip.V4 = tpl->nat_outside;
p = (void *)tpl->data;
output_record->xlate_src_port = compat_nel_bug.port[0];
@ -522,14 +523,14 @@ int i;
if ( (master_record->flags & FLAG_IPV6_ADDR) != 0 ) { // IPv6
// IPv6
// keep compiler happy
// memcpy(p, (void *)master_record->v6.srcaddr, 4 * sizeof(uint64_t));
// memcpy(p, (void *)master_record->V6.srcaddr, 4 * sizeof(uint64_t));
memcpy(p, (void *)master_record->ip_union._ip_64.addr, 4 * sizeof(uint64_t));
p = (void *)((pointer_addr_t)p + 4 * sizeof(uint64_t));
} else {
// IPv4
uint32_t *u = (uint32_t *)p;
u[0] = master_record->v4.srcaddr;
u[1] = master_record->v4.dstaddr;
u[0] = master_record->V4.srcaddr;
u[1] = master_record->V4.dstaddr;
p = (void *)((pointer_addr_t)p + 2 * sizeof(uint32_t));
}
@ -603,24 +604,24 @@ int i;
} break;
case EX_NEXT_HOP_v4: {
tpl_ext_9_t *tpl = (tpl_ext_9_t *)p;
tpl->nexthop = master_record->ip_nexthop.v4;
tpl->nexthop = master_record->ip_nexthop.V4;
p = (void *)tpl->data;
} break;
case EX_NEXT_HOP_v6: {
tpl_ext_10_t *tpl = (tpl_ext_10_t *)p;
tpl->nexthop[0] = master_record->ip_nexthop.v6[0];
tpl->nexthop[1] = master_record->ip_nexthop.v6[1];
tpl->nexthop[0] = master_record->ip_nexthop.V6[0];
tpl->nexthop[1] = master_record->ip_nexthop.V6[1];
p = (void *)tpl->data;
} break;
case EX_NEXT_HOP_BGP_v4: {
tpl_ext_11_t *tpl = (tpl_ext_11_t *)p;
tpl->bgp_nexthop = master_record->bgp_nexthop.v4;
tpl->bgp_nexthop = master_record->bgp_nexthop.V4;
p = (void *)tpl->data;
} break;
case EX_NEXT_HOP_BGP_v6: {
tpl_ext_12_t *tpl = (tpl_ext_12_t *)p;
tpl->bgp_nexthop[0] = master_record->bgp_nexthop.v6[0];
tpl->bgp_nexthop[1] = master_record->bgp_nexthop.v6[1];
tpl->bgp_nexthop[0] = master_record->bgp_nexthop.V6[0];
tpl->bgp_nexthop[1] = master_record->bgp_nexthop.V6[1];
p = (void *)tpl->data;
} break;
case EX_VLAN: {
@ -695,13 +696,13 @@ int i;
} break;
case EX_ROUTER_IP_v4: {
tpl_ext_23_t *tpl = (tpl_ext_23_t *)p;
tpl->router_ip = master_record->ip_router.v4;
tpl->router_ip = master_record->ip_router.V4;
p = (void *)tpl->data;
} break;
case EX_ROUTER_IP_v6: {
tpl_ext_24_t *tpl = (tpl_ext_24_t *)p;
tpl->router_ip[0] = master_record->ip_router.v6[0];
tpl->router_ip[1] = master_record->ip_router.v6[1];
tpl->router_ip[0] = master_record->ip_router.V6[0];
tpl->router_ip[1] = master_record->ip_router.V6[1];
p = (void *)tpl->data;
} break;
case EX_ROUTER_ID: {
@ -741,17 +742,17 @@ int i;
} break;
case EX_NSEL_XLATE_IP_v4: {
tpl_ext_39_t *tpl = (tpl_ext_39_t *)p;
tpl->xlate_src_ip = master_record->xlate_src_ip.v4;
tpl->xlate_dst_ip = master_record->xlate_dst_ip.v4;
tpl->xlate_src_ip = master_record->xlate_src_ip.V4;
tpl->xlate_dst_ip = master_record->xlate_dst_ip.V4;
p = (void *)tpl->data;
} break;
case EX_NSEL_XLATE_IP_v6: {
tpl_ext_40_t *tpl = (tpl_ext_40_t *)p;
tpl->xlate_src_ip[0] = master_record->xlate_src_ip.v6[0];
tpl->xlate_src_ip[1] = master_record->xlate_src_ip.v6[1];
tpl->xlate_src_ip[0] = master_record->xlate_src_ip.V6[0];
tpl->xlate_src_ip[1] = master_record->xlate_src_ip.V6[1];
p = (void *)tpl->data;
tpl->xlate_dst_ip[0] = master_record->xlate_dst_ip.v6[0];
tpl->xlate_dst_ip[1] = master_record->xlate_dst_ip.v6[1];
tpl->xlate_dst_ip[0] = master_record->xlate_dst_ip.V6[0];
tpl->xlate_dst_ip[1] = master_record->xlate_dst_ip.V6[1];
p = (void *)tpl->data;
} break;
case EX_NSEL_ACL: {

50
bin/nfgen.c
View File

@ -96,18 +96,18 @@ static void SetIPaddress(master_record_t *record, int af, char *src_ip, char *d
if ( af == PF_INET6 ) {
SetFlag(record->flags, FLAG_IPV6_ADDR);
inet_pton(PF_INET6, src_ip, &(record->v6.srcaddr[0]));
inet_pton(PF_INET6, dst_ip, &(record->v6.dstaddr[0]));
record->v6.srcaddr[0] = ntohll(record->v6.srcaddr[0]);
record->v6.srcaddr[1] = ntohll(record->v6.srcaddr[1]);
record->v6.dstaddr[0] = ntohll(record->v6.dstaddr[0]);
record->v6.dstaddr[1] = ntohll(record->v6.dstaddr[1]);
inet_pton(PF_INET6, src_ip, &(record->V6.srcaddr[0]));
inet_pton(PF_INET6, dst_ip, &(record->V6.dstaddr[0]));
record->V6.srcaddr[0] = ntohll(record->V6.srcaddr[0]);
record->V6.srcaddr[1] = ntohll(record->V6.srcaddr[1]);
record->V6.dstaddr[0] = ntohll(record->V6.dstaddr[0]);
record->V6.dstaddr[1] = ntohll(record->V6.dstaddr[1]);
} else {
ClearFlag(record->flags, FLAG_IPV6_ADDR);
inet_pton(PF_INET, src_ip, &record->v4.srcaddr);
inet_pton(PF_INET, dst_ip, &record->v4.dstaddr);
record->v4.srcaddr = ntohl(record->v4.srcaddr);
record->v4.dstaddr = ntohl(record->v4.dstaddr);
inet_pton(PF_INET, src_ip, &record->V4.srcaddr);
inet_pton(PF_INET, dst_ip, &record->V4.dstaddr);
record->V4.srcaddr = ntohl(record->V4.srcaddr);
record->V4.dstaddr = ntohl(record->V4.dstaddr);
}
} // End of SetIPaddress
@ -116,13 +116,13 @@ static void SetNextIPaddress(master_record_t *record, int af, char *next_ip) {
if ( af == PF_INET6 ) {
SetFlag(record->flags, FLAG_IPV6_NH);
inet_pton(PF_INET6, next_ip, &(record->ip_nexthop.v6[0]));
record->ip_nexthop.v6[0] = ntohll(record->ip_nexthop.v6[0]);
record->ip_nexthop.v6[1] = ntohll(record->ip_nexthop.v6[1]);
inet_pton(PF_INET6, next_ip, &(record->ip_nexthop.V6[0]));
record->ip_nexthop.V6[0] = ntohll(record->ip_nexthop.V6[0]);
record->ip_nexthop.V6[1] = ntohll(record->ip_nexthop.V6[1]);
} else {
ClearFlag(record->flags, FLAG_IPV6_NH);
inet_pton(PF_INET, next_ip, &record->ip_nexthop.v4);
record->ip_nexthop.v4 = ntohl(record->ip_nexthop.v4);
inet_pton(PF_INET, next_ip, &record->ip_nexthop.V4);
record->ip_nexthop.V4 = ntohl(record->ip_nexthop.V4);
}
} // End of SetNextIPaddress
@ -131,13 +131,13 @@ static void SetRouterIPaddress(master_record_t *record, int af, char *next_ip)
if ( af == PF_INET6 ) {
SetFlag(record->flags, FLAG_IPV6_NH);
inet_pton(PF_INET6, next_ip, &(record->ip_router.v6[0]));
record->ip_router.v6[0] = ntohll(record->ip_router.v6[0]);
record->ip_router.v6[1] = ntohll(record->ip_router.v6[1]);
inet_pton(PF_INET6, next_ip, &(record->ip_router.V6[0]));
record->ip_router.V6[0] = ntohll(record->ip_router.V6[0]);
record->ip_router.V6[1] = ntohll(record->ip_router.V6[1]);
} else {
ClearFlag(record->flags, FLAG_IPV6_NH);
inet_pton(PF_INET, next_ip, &record->ip_router.v4);
record->ip_router.v4 = ntohl(record->ip_router.v4);
inet_pton(PF_INET, next_ip, &record->ip_router.V4);
record->ip_router.V4 = ntohl(record->ip_router.V4);
}
} // End of SetRouterIPaddress
@ -146,13 +146,13 @@ static void SetBGPNextIPaddress(master_record_t *record, int af, char *next_ip)
if ( af == PF_INET6 ) {
SetFlag(record->flags, FLAG_IPV6_NHB);
inet_pton(PF_INET6, next_ip, &(record->bgp_nexthop.v6[0]));
record->bgp_nexthop.v6[0] = ntohll(record->bgp_nexthop.v6[0]);
record->bgp_nexthop.v6[1] = ntohll(record->bgp_nexthop.v6[1]);
inet_pton(PF_INET6, next_ip, &(record->bgp_nexthop.V6[0]));
record->bgp_nexthop.V6[0] = ntohll(record->bgp_nexthop.V6[0]);
record->bgp_nexthop.V6[1] = ntohll(record->bgp_nexthop.V6[1]);
} else {
ClearFlag(record->flags, FLAG_IPV6_NHB);
inet_pton(PF_INET, next_ip, &record->bgp_nexthop.v4);
record->bgp_nexthop.v4 = ntohl(record->bgp_nexthop.v4);
inet_pton(PF_INET, next_ip, &record->bgp_nexthop.V4);
record->bgp_nexthop.V4 = ntohl(record->bgp_nexthop.V4);
}
} // End of SetBGPNextIPaddress

23
bin/nflowcache.c
View File

@ -1,4 +1,5 @@
/*
* Copyright (c) 2017, Peter Haag
* Copyright (c) 2014, Peter Haag
* Copyright (c) 2009, Peter Haag
* Copyright (c) 2004-2008, SWITCH - Teleinformatikdienste fuer Lehre und Forschung
@ -28,12 +29,6 @@
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
* POSSIBILITY OF SUCH DAMAGE.
*
* $Author: haag $
*
* $Id: nflowcache.c 40 2009-12-16 10:41:44Z haag $
*
* $LastChangedRevision: 40 $
*
*/
#include "config.h"
@ -916,20 +911,20 @@ Default_key_t *keyptr;
} else if ( swap_flow ) {
// default 5-tuple aggregation for bidirectional flows
keyptr = (Default_key_t *)keymem;
keyptr->srcaddr[0] = flow_record->v6.dstaddr[0];
keyptr->srcaddr[1] = flow_record->v6.dstaddr[1];
keyptr->dstaddr[0] = flow_record->v6.srcaddr[0];
keyptr->dstaddr[1] = flow_record->v6.srcaddr[1];
keyptr->srcaddr[0] = flow_record->V6.dstaddr[0];
keyptr->srcaddr[1] = flow_record->V6.dstaddr[1];
keyptr->dstaddr[0] = flow_record->V6.srcaddr[0];
keyptr->dstaddr[1] = flow_record->V6.srcaddr[1];
keyptr->srcport = flow_record->dstport;
keyptr->dstport = flow_record->srcport;
keyptr->proto = flow_record->prot;
} else {
// default 5-tuple aggregation
keyptr = (Default_key_t *)keymem;
keyptr->srcaddr[0] = flow_record->v6.srcaddr[0];
keyptr->srcaddr[1] = flow_record->v6.srcaddr[1];
keyptr->dstaddr[0] = flow_record->v6.dstaddr[0];
keyptr->dstaddr[1] = flow_record->v6.dstaddr[1];
keyptr->srcaddr[0] = flow_record->V6.srcaddr[0];
keyptr->srcaddr[1] = flow_record->V6.srcaddr[1];
keyptr->dstaddr[0] = flow_record->V6.dstaddr[0];
keyptr->dstaddr[1] = flow_record->V6.dstaddr[1];
keyptr->srcport = flow_record->srcport;
keyptr->dstport = flow_record->dstport;
keyptr->proto = flow_record->prot;

27
bin/nfreader.c
View File

@ -29,13 +29,6 @@
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
* POSSIBILITY OF SUCH DAMAGE.
*
* $Author: haag $
*
* $Id: nfreader.c 48 2010-01-02 08:06:27Z haag $
*
* $LastChangedRevision: 48 $
*
*
*/
/*
@ -124,17 +117,17 @@ struct tm *ts;
master_record_t *r = (master_record_t *)record;
if ( (r->flags & FLAG_IPV6_ADDR ) != 0 ) { // IPv6
r->v6.srcaddr[0] = htonll(r->v6.srcaddr[0]);
r->v6.srcaddr[1] = htonll(r->v6.srcaddr[1]);
r->v6.dstaddr[0] = htonll(r->v6.dstaddr[0]);
r->v6.dstaddr[1] = htonll(r->v6.dstaddr[1]);
inet_ntop(AF_INET6, r->v6.srcaddr, as, sizeof(as));
inet_ntop(AF_INET6, r->v6.dstaddr, ds, sizeof(ds));
r->V6.srcaddr[0] = htonll(r->V6.srcaddr[0]);
r->V6.srcaddr[1] = htonll(r->V6.srcaddr[1]);
r->V6.dstaddr[0] = htonll(r->V6.dstaddr[0]);
r->V6.dstaddr[1] = htonll(r->V6.dstaddr[1]);
inet_ntop(AF_INET6, r->V6.srcaddr, as, sizeof(as));
inet_ntop(AF_INET6, r->V6.dstaddr, ds, sizeof(ds));
} else { // IPv4
r->v4.srcaddr = htonl(r->v4.srcaddr);
r->v4.dstaddr = htonl(r->v4.dstaddr);
inet_ntop(AF_INET, &r->v4.srcaddr, as, sizeof(as));
inet_ntop(AF_INET, &r->v4.dstaddr, ds, sizeof(ds));
r->V4.srcaddr = htonl(r->V4.srcaddr);
r->V4.dstaddr = htonl(r->V4.dstaddr);
inet_ntop(AF_INET, &r->V4.srcaddr, as, sizeof(as));
inet_ntop(AF_INET, &r->V4.dstaddr, ds, sizeof(ds));
}
as[40-1] = 0;
ds[40-1] = 0;

28
bin/nfstat.c
View File

@ -1543,10 +1543,10 @@ char *string;
// apply IP mask from aggregation, to provide a pretty output
if ( FlowTable->has_masks ) {
flow_record->v6.srcaddr[0] &= FlowTable->IPmask[0];
flow_record->v6.srcaddr[1] &= FlowTable->IPmask[1];
flow_record->v6.dstaddr[0] &= FlowTable->IPmask[2];
flow_record->v6.dstaddr[1] &= FlowTable->IPmask[3];
flow_record->V6.srcaddr[0] &= FlowTable->IPmask[0];
flow_record->V6.srcaddr[1] &= FlowTable->IPmask[1];
flow_record->V6.dstaddr[0] &= FlowTable->IPmask[2];
flow_record->V6.dstaddr[1] &= FlowTable->IPmask[3];
}
if ( aggr_record_mask ) {
@ -1718,10 +1718,10 @@ int i, max;
// apply IP mask from aggregation, to provide a pretty output
if ( FlowTable->has_masks ) {
flow_record->v6.srcaddr[0] &= FlowTable->IPmask[0];
flow_record->v6.srcaddr[1] &= FlowTable->IPmask[1];
flow_record->v6.dstaddr[0] &= FlowTable->IPmask[2];
flow_record->v6.dstaddr[1] &= FlowTable->IPmask[3];
flow_record->V6.srcaddr[0] &= FlowTable->IPmask[0];
flow_record->V6.srcaddr[1] &= FlowTable->IPmask[1];
flow_record->V6.dstaddr[0] &= FlowTable->IPmask[2];
flow_record->V6.dstaddr[1] &= FlowTable->IPmask[3];
}
if ( FlowTable->apply_netbits ) {
@ -1887,12 +1887,12 @@ uint64_t _tmp_ip[2];
uint64_t _tmp_l;
uint32_t _tmp;
_tmp_ip[0] = flow_record->v6.srcaddr[0];
_tmp_ip[1] = flow_record->v6.srcaddr[1];
flow_record->v6.srcaddr[0] = flow_record->v6.dstaddr[0];
flow_record->v6.srcaddr[1] = flow_record->v6.dstaddr[1];
flow_record->v6.dstaddr[0] = _tmp_ip[0];
flow_record->v6.dstaddr[1] = _tmp_ip[1];
_tmp_ip[0] = flow_record->V6.srcaddr[0];
_tmp_ip[1] = flow_record->V6.srcaddr[1];
flow_record->V6.srcaddr[0] = flow_record->V6.dstaddr[0];
flow_record->V6.srcaddr[1] = flow_record->V6.dstaddr[1];
flow_record->V6.dstaddr[0] = _tmp_ip[0];
flow_record->V6.dstaddr[1] = _tmp_ip[1];
_tmp = flow_record->srcport;
flow_record->srcport = flow_record->dstport;

174
bin/nftest.c
View File

@ -368,12 +368,12 @@ void *p;
ret = check_filter_block("icmp-code 4", &flow_record, 0);
inet_pton(PF_INET6, "fe80::2110:abcd:1234:5678", flow_record.v6.srcaddr);
inet_pton(PF_INET6, "fe80::1104:fedc:4321:8765", flow_record.v6.dstaddr);
flow_record.v6.srcaddr[0] = ntohll(flow_record.v6.srcaddr[0]);
flow_record.v6.srcaddr[1] = ntohll(flow_record.v6.srcaddr[1]);
flow_record.v6.dstaddr[0] = ntohll(flow_record.v6.dstaddr[0]);
flow_record.v6.dstaddr[1] = ntohll(flow_record.v6.dstaddr[1]);
inet_pton(PF_INET6, "fe80::2110:abcd:1234:5678", flow_record.V6.srcaddr);
inet_pton(PF_INET6, "fe80::1104:fedc:4321:8765", flow_record.V6.dstaddr);
flow_record.V6.srcaddr[0] = ntohll(flow_record.V6.srcaddr[0]);
flow_record.V6.srcaddr[1] = ntohll(flow_record.V6.srcaddr[1]);
flow_record.V6.dstaddr[0] = ntohll(flow_record.V6.dstaddr[0]);
flow_record.V6.dstaddr[1] = ntohll(flow_record.V6.dstaddr[1]);
ret = check_filter_block("src ip fe80::2110:abcd:1234:5678", &flow_record, 1);
ret = check_filter_block("src ip fe80::2110:abcd:1234:5679", &flow_record, 0);
ret = check_filter_block("src ip fe80::2111:abcd:1234:5678", &flow_record, 0);
@ -390,39 +390,39 @@ void *p;
ret = check_filter_block("src ip in [fe80::2110:abcd:1234:5678]", &flow_record, 1);
ret = check_filter_block("src ip in [fe80::2110:abcd:1234:5679]", &flow_record, 0);
inet_pton(PF_INET6, "fe80::2110:abcd:1234:0", flow_record.v6.srcaddr);
flow_record.v6.srcaddr[0] = ntohll(flow_record.v6.srcaddr[0]);
flow_record.v6.srcaddr[1] = ntohll(flow_record.v6.srcaddr[1]);
inet_pton(PF_INET6, "fe80::2110:abcd:1234:0", flow_record.V6.srcaddr);
flow_record.V6.srcaddr[0] = ntohll(flow_record.V6.srcaddr[0]);
flow_record.V6.srcaddr[1] = ntohll(flow_record.V6.srcaddr[1]);
ret = check_filter_block("src net fe80::2110:abcd:1234:0/112", &flow_record, 1);
inet_pton(PF_INET6, "fe80::2110:abcd:1234:ffff", flow_record.v6.srcaddr);
flow_record.v6.srcaddr[0] = ntohll(flow_record.v6.srcaddr[0]);
flow_record.v6.srcaddr[1] = ntohll(flow_record.v6.srcaddr[1]);
inet_pton(PF_INET6, "fe80::2110:abcd:1234:ffff", flow_record.V6.srcaddr);
flow_record.V6.srcaddr[0] = ntohll(flow_record.V6.srcaddr[0]);
flow_record.V6.srcaddr[1] = ntohll(flow_record.V6.srcaddr[1]);
ret = check_filter_block("src net fe80::2110:abcd:1234:0/112", &flow_record, 1);
inet_pton(PF_INET6, "fe80::2110:abcd:1235:ffff", flow_record.v6.srcaddr);
flow_record.v6.srcaddr[0] = ntohll(flow_record.v6.srcaddr[0]);
flow_record.v6.srcaddr[1] = ntohll(flow_record.v6.srcaddr[1]);
inet_pton(PF_INET6, "fe80::2110:abcd:1235:ffff", flow_record.V6.srcaddr);
flow_record.V6.srcaddr[0] = ntohll(flow_record.V6.srcaddr[0]);
flow_record.V6.srcaddr[1] = ntohll(flow_record.V6.srcaddr[1]);
ret = check_filter_block("src net fe80::2110:abcd:1234:0/112", &flow_record, 0);
ret = check_filter_block("src net fe80::0/16", &flow_record, 1);
ret = check_filter_block("src net fe81::0/16", &flow_record, 0);
flow_record.v6.srcaddr[0] = 0;
flow_record.v6.srcaddr[1] = 0;
flow_record.V6.srcaddr[0] = 0;
flow_record.V6.srcaddr[1] = 0;
inet_pton(PF_INET6, "fe80::2110:abcd:1234:0", flow_record.v6.dstaddr);
flow_record.v6.dstaddr[0] = ntohll(flow_record.v6.dstaddr[0]);
flow_record.v6.dstaddr[1] = ntohll(flow_record.v6.dstaddr[1]);
inet_pton(PF_INET6, "fe80::2110:abcd:1234:0", flow_record.V6.dstaddr);
flow_record.V6.dstaddr[0] = ntohll(flow_record.V6.dstaddr[0]);
flow_record.V6.dstaddr[1] = ntohll(flow_record.V6.dstaddr[1]);
ret = check_filter_block("dst net fe80::2110:abcd:1234:0/112", &flow_record, 1);
inet_pton(PF_INET6, "fe80::2110:abcd:1234:ffff", flow_record.v6.dstaddr);
flow_record.v6.dstaddr[0] = ntohll(flow_record.v6.dstaddr[0]);
flow_record.v6.dstaddr[1] = ntohll(flow_record.v6.dstaddr[1]);
inet_pton(PF_INET6, "fe80::2110:abcd:1234:ffff", flow_record.V6.dstaddr);
flow_record.V6.dstaddr[0] = ntohll(flow_record.V6.dstaddr[0]);
flow_record.V6.dstaddr[1] = ntohll(flow_record.V6.dstaddr[1]);
ret = check_filter_block("dst net fe80::2110:abcd:1234:0/112", &flow_record, 1);
inet_pton(PF_INET6, "fe80::2110:abcd:1235:ffff", flow_record.v6.dstaddr);
flow_record.v6.dstaddr[0] = ntohll(flow_record.v6.dstaddr[0]);
flow_record.v6.dstaddr[1] = ntohll(flow_record.v6.dstaddr[1]);
inet_pton(PF_INET6, "fe80::2110:abcd:1235:ffff", flow_record.V6.dstaddr);
flow_record.V6.dstaddr[0] = ntohll(flow_record.V6.dstaddr[0]);
flow_record.V6.dstaddr[1] = ntohll(flow_record.V6.dstaddr[1]);
ret = check_filter_block("dst net fe80::2110:abcd:1234:0/112", &flow_record, 0);
ret = check_filter_block("dst net fe80::0/16", &flow_record, 1);
ret = check_filter_block("not dst net fe80::0/16", &flow_record, 0);
@ -433,12 +433,12 @@ void *p;
/* 172.32.7.16 => 0xac200710
* 10.10.10.11 => 0x0a0a0a0b
*/
flow_record.v6.srcaddr[0] = 0;
flow_record.v6.srcaddr[1] = 0;
flow_record.v6.dstaddr[0] = 0;
flow_record.v6.dstaddr[1] = 0;
flow_record.v4.srcaddr = 0xac200710;
flow_record.v4.dstaddr = 0x0a0a0a0b;
flow_record.V6.srcaddr[0] = 0;
flow_record.V6.srcaddr[1] = 0;
flow_record.V6.dstaddr[0] = 0;
flow_record.V6.dstaddr[1] = 0;
flow_record.V4.srcaddr = 0xac200710;
flow_record.V4.dstaddr = 0x0a0a0a0b;
ret = check_filter_block("src ip 172.32.7.16", &flow_record, 1);
ret = check_filter_block("src ip 172.32.7.15", &flow_record, 0);
ret = check_filter_block("dst ip 10.10.10.11", &flow_record, 1);
@ -596,53 +596,53 @@ void *p;
ret = check_filter_block("src ip 172.32.7.15 and dst ip 10.10.10.11", &flow_record, 0);
ret = check_filter_block("src ip 172.32.7.16 and dst ip 10.10.10.12", &flow_record, 0);
flow_record.v4.srcaddr = 0;
flow_record.v4.dstaddr = 0;
flow_record.V4.srcaddr = 0;
flow_record.V4.dstaddr = 0;
// 172.32.7.16 => 0xac200710
flow_record.ip_nexthop.v6[0] = 0;
flow_record.ip_nexthop.v6[1] = 0;
flow_record.ip_nexthop.v4 = 0xac200710;
flow_record.ip_nexthop.V6[0] = 0;
flow_record.ip_nexthop.V6[1] = 0;
flow_record.ip_nexthop.V4 = 0xac200710;
ret = check_filter_block("next ip 172.32.7.16", &flow_record, 1);
ret = check_filter_block("next ip 172.32.7.15", &flow_record, 0);
ret = check_filter_block("next ip in [172.32.7.16 fe80::2110:abcd:1235:ffff]", &flow_record, 1);
ret = check_filter_block("next ip in [172.32.7.15 fe80::2110:abcd:1235:ffff]", &flow_record, 0);
inet_pton(PF_INET6, "fe80::2110:abcd:1235:ffff", flow_record.ip_nexthop.v6);
flow_record.ip_nexthop.v6[0] = ntohll(flow_record.ip_nexthop.v6[0]);
flow_record.ip_nexthop.v6[1] = ntohll(flow_record.ip_nexthop.v6[1]);
inet_pton(PF_INET6, "fe80::2110:abcd:1235:ffff", flow_record.ip_nexthop.V6);
flow_record.ip_nexthop.V6[0] = ntohll(flow_record.ip_nexthop.V6[0]);
flow_record.ip_nexthop.V6[1] = ntohll(flow_record.ip_nexthop.V6[1]);
ret = check_filter_block("next ip fe80::2110:abcd:1235:ffff", &flow_record, 1);
ret = check_filter_block("next ip in [172.32.7.16 fe80::2110:abcd:1235:ffff]", &flow_record, 1);
ret = check_filter_block("next ip in [172.32.7.16 fe80::2110:abcd:1235:fffe]", &flow_record, 0);
ret = check_filter_block("next ip fe80::2110:abcd:1235:fffe", &flow_record, 0);
ret = check_filter_block("next ip fe81::2110:abcd:1235:ffff", &flow_record, 0);
flow_record.ip_nexthop.v6[0] = 0;
flow_record.ip_nexthop.v6[1] = 0;
flow_record.ip_nexthop.V6[0] = 0;
flow_record.ip_nexthop.V6[1] = 0;
flow_record.bgp_nexthop.v6[0] = 0;
flow_record.bgp_nexthop.v6[1] = 0;
flow_record.bgp_nexthop.v4 = 0xac200710;
flow_record.bgp_nexthop.V6[0] = 0;
flow_record.bgp_nexthop.V6[1] = 0;
flow_record.bgp_nexthop.V4 = 0xac200710;
ret = check_filter_block("bgpnext ip 172.32.7.16", &flow_record, 1);
ret = check_filter_block("bgpnext ip 172.32.7.15", &flow_record, 0);
inet_pton(PF_INET6, "fe80::2110:abcd:1235:ffff", flow_record.bgp_nexthop.v6);
flow_record.bgp_nexthop.v6[0] = ntohll(flow_record.bgp_nexthop.v6[0]);
flow_record.bgp_nexthop.v6[1] = ntohll(flow_record.bgp_nexthop.v6[1]);
inet_pton(PF_INET6, "fe80::2110:abcd:1235:ffff", flow_record.bgp_nexthop.V6);
flow_record.bgp_nexthop.V6[0] = ntohll(flow_record.bgp_nexthop.V6[0]);
flow_record.bgp_nexthop.V6[1] = ntohll(flow_record.bgp_nexthop.V6[1]);
ret = check_filter_block("bgpnext ip fe80::2110:abcd:1235:ffff", &flow_record, 1);
ret = check_filter_block("bgpnext ip fe80::2110:abcd:1235:fffe", &flow_record, 0);
ret = check_filter_block("bgpnext ip fe81::2110:abcd:1235:ffff", &flow_record, 0);
flow_record.ip_router.v6[0] = 0;
flow_record.ip_router.v6[1] = 0;
flow_record.ip_router.v4 = 0xac200720;
flow_record.ip_nexthop.v4 = 0xac200720;
flow_record.ip_router.V6[0] = 0;
flow_record.ip_router.V6[1] = 0;
flow_record.ip_router.V4 = 0xac200720;
flow_record.ip_nexthop.V4 = 0xac200720;
ret = check_filter_block("router ip 172.32.7.32", &flow_record, 1);
ret = check_filter_block("router ip 172.32.7.33", &flow_record, 0);
inet_pton(PF_INET6, "fe80::2110:abcd:1235:ffff", flow_record.ip_router.v6);
flow_record.ip_router.v6[0] = ntohll(flow_record.ip_router.v6[0]);
flow_record.ip_router.v6[1] = ntohll(flow_record.ip_router.v6[1]);
inet_pton(PF_INET6, "fe80::2110:abcd:1235:ffff", flow_record.ip_router.V6);
flow_record.ip_router.V6[0] = ntohll(flow_record.ip_router.V6[0]);
flow_record.ip_router.V6[1] = ntohll(flow_record.ip_router.V6[1]);
ret = check_filter_block("router ip fe80::2110:abcd:1235:ffff", &flow_record, 1);
ret = check_filter_block("router ip fe80::2110:abcd:1235:fffe", &flow_record, 0);
ret = check_filter_block("router ip fe81::2110:abcd:1235:ffff", &flow_record, 0);
@ -1039,12 +1039,12 @@ void *p;
ret = check_filter_block("asa xevent < 1004", &flow_record, 0);
ret = check_filter_block("asa xevent > 1004", &flow_record, 0);
flow_record.xlate_src_ip.v6[0] = 0;
flow_record.xlate_src_ip.v6[1] = 0;
flow_record.xlate_src_ip.v4 = 0xac200710;
flow_record.xlate_dst_ip.v6[0] = 0;
flow_record.xlate_dst_ip.v6[1] = 0;
flow_record.xlate_dst_ip.v4 = 0x0a0a0a0b;
flow_record.xlate_src_ip.V6[0] = 0;
flow_record.xlate_src_ip.V6[1] = 0;
flow_record.xlate_src_ip.V4 = 0xac200710;
flow_record.xlate_dst_ip.V6[0] = 0;
flow_record.xlate_dst_ip.V6[1] = 0;
flow_record.xlate_dst_ip.V4 = 0x0a0a0a0b;
ret = check_filter_block("src xip 172.32.7.16", &flow_record, 1);
ret = check_filter_block("src xip 172.32.7.15", &flow_record, 0);
ret = check_filter_block("dst xip 10.10.10.11", &flow_record, 1);
@ -1060,23 +1060,23 @@ void *p;
ret = check_filter_block("xnet 172.32.7.0/24", &flow_record, 1);
ret = check_filter_block("xnet 10.10.10.0/24", &flow_record, 1);
inet_pton(PF_INET6, "fe80::2110:abcd:1235:ffff", flow_record.xlate_src_ip.v6);
flow_record.xlate_src_ip.v6[0] = ntohll(flow_record.xlate_src_ip.v6[0]);
flow_record.xlate_src_ip.v6[1] = ntohll(flow_record.xlate_src_ip.v6[1]);
inet_pton(PF_INET6, "fe80::2110:abcd:1235:ffff", flow_record.xlate_src_ip.V6);
flow_record.xlate_src_ip.V6[0] = ntohll(flow_record.xlate_src_ip.V6[0]);
flow_record.xlate_src_ip.V6[1] = ntohll(flow_record.xlate_src_ip.V6[1]);
ret = check_filter_block("src xip fe80::2110:abcd:1235:ffff", &flow_record, 1);
ret = check_filter_block("src xip fe80::2110:abcd:1235:fffe", &flow_record, 0);
flow_record.xlate_src_ip.v6[0] = 0;
flow_record.xlate_src_ip.v6[1] = 0;
inet_pton(PF_INET6, "fe80::2110:abcd:1235:fffe", flow_record.xlate_dst_ip.v6);
flow_record.xlate_dst_ip.v6[0] = ntohll(flow_record.xlate_dst_ip.v6[0]);
flow_record.xlate_dst_ip.v6[1] = ntohll(flow_record.xlate_dst_ip.v6[1]);
flow_record.xlate_src_ip.V6[0] = 0;
flow_record.xlate_src_ip.V6[1] = 0;
inet_pton(PF_INET6, "fe80::2110:abcd:1235:fffe", flow_record.xlate_dst_ip.V6);
flow_record.xlate_dst_ip.V6[0] = ntohll(flow_record.xlate_dst_ip.V6[0]);
flow_record.xlate_dst_ip.V6[1] = ntohll(flow_record.xlate_dst_ip.V6[1]);
ret = check_filter_block("dst xip fe80::2110:abcd:1235:fffe", &flow_record, 1);
ret = check_filter_block("dst xip fe80::2110:abcd:1235:fffc", &flow_record, 0);
flow_record.xlate_src_ip.v6[0] = 0;
flow_record.xlate_src_ip.v6[1] = 0;
flow_record.xlate_dst_ip.v6[0] = 0;
flow_record.xlate_dst_ip.v6[1] = 0;
flow_record.xlate_src_ip.V6[0] = 0;
flow_record.xlate_src_ip.V6[1] = 0;
flow_record.xlate_dst_ip.V6[0] = 0;
flow_record.xlate_dst_ip.V6[1] = 0;
flow_record.xlate_src_port = 1023;
flow_record.xlate_dst_port = 32798;
@ -1205,12 +1205,12 @@ exit(0);
flow_record.xlate_src_port = 0xffff;
flow_record.xlate_dst_port = 0xffff;
flow_record.xlate_src_ip.v6[0] = 0;
flow_record.xlate_src_ip.v6[1] = 0;
flow_record.xlate_src_ip.v4 = 0xac200710;
flow_record.xlate_dst_ip.v6[0] = 0;
flow_record.xlate_dst_ip.v6[1] = 0;
flow_record.xlate_dst_ip.v4 = 0x0a0a0a0b;
flow_record.xlate_src_ip.V6[0] = 0;
flow_record.xlate_src_ip.V6[1] = 0;
flow_record.xlate_src_ip.V4 = 0xac200710;
flow_record.xlate_dst_ip.V6[0] = 0;
flow_record.xlate_dst_ip.V6[1] = 0;
flow_record.xlate_dst_ip.V4 = 0x0a0a0a0b;
ret = check_filter_block("src nip 172.32.7.16", &flow_record, 1);
ret = check_filter_block("src nip 172.32.7.15", &flow_record, 0);
ret = check_filter_block("dst nip 10.10.10.11", &flow_record, 1);
@ -1220,17 +1220,17 @@ exit(0);
ret = check_filter_block("nip 172.32.7.15", &flow_record, 0);
ret = check_filter_block("nip 10.10.10.12", &flow_record, 0);
inet_pton(PF_INET6, "fe80::2110:abcd:1235:ffff", flow_record.xlate_src_ip.v6);
flow_record.xlate_src_ip.v6[0] = ntohll(flow_record.xlate_src_ip.v6[0]);
flow_record.xlate_src_ip.v6[1] = ntohll(flow_record.xlate_src_ip.v6[1]);
inet_pton(PF_INET6, "fe80::2110:abcd:1235:ffff", flow_record.xlate_src_ip.V6);
flow_record.xlate_src_ip.V6[0] = ntohll(flow_record.xlate_src_ip.V6[0]);
flow_record.xlate_src_ip.V6[1] = ntohll(flow_record.xlate_src_ip.V6[1]);
ret = check_filter_block("src nip fe80::2110:abcd:1235:ffff", &flow_record, 1);
ret = check_filter_block("src nip fe80::2110:abcd:1235:fffe", &flow_record, 0);
flow_record.xlate_src_ip.v6[0] = 0;
flow_record.xlate_src_ip.v6[1] = 0;
inet_pton(PF_INET6, "fe80::2110:abcd:1235:fffe", flow_record.xlate_dst_ip.v6);
flow_record.xlate_dst_ip.v6[0] = ntohll(flow_record.xlate_dst_ip.v6[0]);
flow_record.xlate_dst_ip.v6[1] = ntohll(flow_record.xlate_dst_ip.v6[1]);
flow_record.xlate_src_ip.V6[0] = 0;
flow_record.xlate_src_ip.V6[1] = 0;
inet_pton(PF_INET6, "fe80::2110:abcd:1235:fffe", flow_record.xlate_dst_ip.V6);
flow_record.xlate_dst_ip.V6[0] = ntohll(flow_record.xlate_dst_ip.V6[0]);
flow_record.xlate_dst_ip.V6[1] = ntohll(flow_record.xlate_dst_ip.V6[1]);
ret = check_filter_block("dst nip fe80::2110:abcd:1235:fffe", &flow_record, 1);
ret = check_filter_block("dst nip fe80::2110:abcd:1235:fffc", &flow_record, 0);

BIN
bin/pack.pcap
View File

Binary file not shown.

2
bin/sfcapd.c
View File

@ -91,7 +91,7 @@
#include "expire.h"
#include "sflow.h"
#include "sflow_nfdump.h"
#define DEFAULTSFLOWPORT "6343"

2751
bin/sflow.c
View File

File diff suppressed because it is too large Load Diff

1800
bin/sflow.h
View File

File diff suppressed because it is too large Load Diff

4431
bin/sflow_nfdump.c Normal file
View File

File diff suppressed because it is too large Load Diff

55
bin/sflow_nfdump.h Normal file
View File

@ -0,0 +1,55 @@
/*
* Copyright (c) 2017, Peter Haag
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions are met:
*
* * Redistributions of source code must retain the above copyright notice,
* this list of conditions and the following disclaimer.
* * Redistributions in binary form must reproduce the above copyright notice,
* this list of conditions and the following disclaimer in the documentation
* and/or other materials provided with the distribution.
* * Neither the name of the author nor the names of its contributors may be
* used to endorse or promote products derived from this software without
* specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
* AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
* LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
* CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
* SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
* CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
* POSSIBILITY OF SUCH DAMAGE.
*
*/
#ifndef _SFLOW_NFDUMP_H
#define _SFLOW_NFDUMP_H 1
void Init_sflow(void);
void Process_sflow(void *in_buff, ssize_t in_buff_cnt, FlowSource_t *fs);
/*
* Extension map for sflow ( compatibility for now )
*
* Required extensions:
*
* 4 byte byte counter
* | 4byte packet counter
* | | IPv4
* | | |
* xxxx x0 0 0
*
* Optional extensions:
*
* 4 : 2 byte input/output interface id
* 6 : 2 byte src/dst as
*/
#endif // _SFLOW_NFDUMP_H

702
bin/sflow_proto.h
View File

@ -1,702 +0,0 @@
/*
* Copyright (c) 2014, Peter Haag
* Copyright (c) 2009, Peter Haag
* Copyright (c) 2004-2008, SWITCH - Teleinformatikdienste fuer Lehre und Forschung
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions are met:
*
* * Redistributions of source code must retain the above copyright notice,
* this list of conditions and the following disclaimer.
* * Redistributions in binary form must reproduce the above copyright notice,
* this list of conditions and the following disclaimer in the documentation
* and/or other materials provided with the distribution.
* * Neither the name of the author nor the names of its contributors may be
* used to endorse or promote products derived from this software without
* specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
* AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
* LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
* CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
* SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
* CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
* POSSIBILITY OF SUCH DAMAGE.
*
* $Author: haag $
*
* $Id: sflow_proto.h 39 2009-11-25 08:11:15Z haag $
*
* $LastChangedRevision: 39 $
*
*
*/
/*
* sfcapd makes use of code originated from sflowtool by InMon Corp.
* Those parts of the code are distributed under the InMon Public License below.
* All other/additional code is pubblished under BSD license.
*/
/*
* -----------------------------------------------------------------------
* Copyright (c) 2001-2002 InMon Corp. All rights reserved.
* -----------------------------------------------------------------------
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
*
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
*
* 2. Redistributions in binary form must reproduce the above
* copyright notice, this list of conditions and the following
* disclaimer in the documentation and/or other materials provided
* with the distribution.
*
* 3. Redistributions of any form whatsoever must retain the following
* acknowledgment:
* "This product includes sFlow(TM), freely available from
* http://www.inmon.com/".
*
* 4. All advertising materials mentioning features or use of this
* software must display the following acknowledgment:
* "This product includes sFlow(TM), freely available from
* http://www.inmon.com/".
*
* 5. InMon Corp. may publish revised and/or new versions
* of the license from time to time. Each version will be given a
* distinguishing version number. Once covered code has been
* published under a particular version of the license, you may
* always continue to use it under the terms of that version. You
* may also choose to use such covered code under the terms of any
* subsequent version of the license published by InMon Corp.
* No one other than the InMon Corp. has the right to modify the terms
* applicable to covered code created under this License.
*
* 6. The name "sFlow" must not be used to endorse or promote products
* derived from this software without prior written permission
* from InMon Corp. This does not apply to add-on libraries or tools
* that work in conjunction with sFlow. In such a case the sFlow name
* may be used to indicate that the product supports sFlow.
*
* 7. Products derived from this software may not be called "sFlow",
* nor may "sFlow" appear in their name, without prior written
* permission of InMon Corp.
*
*
* THIS SOFTWARE IS PROVIDED BY INMON CORP. ``AS IS'' AND
* ANY EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
* THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
* PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
* INMON CORP. OR ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
* INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
* (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
* SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
* OF THE POSSIBILITY OF SUCH DAMAGE.
*
* --------------------------------------------------------------------
*
* This software consists of voluntary contributions made by many
* individuals on behalf of InMon Corp.
*
* InMon Corp. can be contacted via Email at info@inmon.com.
*
* For more information on InMon Corp. and sFlow,
* please see http://www.inmon.com/.
*
* InMon Public License Version 1.0 written May 31, 2001
*
*/
/////////////////////////////////////////////////////////////////////////////////
/////////////////////// sFlow Sampling Packet Data Types ////////////////////////
/////////////////////////////////////////////////////////////////////////////////
#ifndef _SFLOW_PROTO_H
#define _SFLOW_PROTO_H 1
#if defined(__cplusplus)
extern "C" {
#endif
enum SFLAddress_type {
SFLADDRESSTYPE_IP_V4 = 1,
SFLADDRESSTYPE_IP_V6 = 2
};
typedef union _SFLAddress_value {
struct in_addr ip_v4;
struct in6_addr ip_v6;
} SFLAddress_value;
typedef struct _SFLAddress {
uint32_t type; /* enum SFLAddress_type */
SFLAddress_value address;
} SFLAddress;
/* Packet header data */
#define SFL_DEFAULT_HEADER_SIZE 128
#define SFL_DEFAULT_COLLECTOR_PORT 6343
#define SFL_DEFAULT_SAMPLING_RATE 400
/* The header protocol describes the format of the sampled header */
enum SFLHeader_protocol {
SFLHEADER_ETHERNET_ISO8023 = 1,
SFLHEADER_ISO88024_TOKENBUS = 2,
SFLHEADER_ISO88025_TOKENRING = 3,
SFLHEADER_FDDI = 4,
SFLHEADER_FRAME_RELAY = 5,
SFLHEADER_X25 = 6,
SFLHEADER_PPP = 7,
SFLHEADER_SMDS = 8,
SFLHEADER_AAL5 = 9,
SFLHEADER_AAL5_IP = 10, /* e.g. Cisco AAL5 mux */
SFLHEADER_IPv4 = 11,
SFLHEADER_IPv6 = 12,
SFLHEADER_MPLS = 13
};
/* raw sampled header */
typedef struct _SFLSampled_header {
uint32_t header_protocol; /* (enum SFLHeader_protocol) */
uint32_t frame_length; /* Original length of packet before sampling */
uint32_t stripped; /* header/trailer bytes stripped by sender */
uint32_t header_length; /* length of sampled header bytes to follow */
uint8_t *header_bytes; /* Header bytes */
} SFLSampled_header;
/* decoded ethernet header */
typedef struct _SFLSampled_ethernet {
uint32_t eth_len; /* The length of the MAC packet excluding
lower layer encapsulations */
uint8_t src_mac[8]; /* 6 bytes + 2 pad */
uint8_t dst_mac[8];
uint32_t eth_type;
} SFLSampled_ethernet;
/* decoded IP version 4 header */
typedef struct _SFLSampled_ipv4 {
uint32_t length; /* The length of the IP packet
excluding lower layer encapsulations */
uint32_t protocol; /* IP Protocol type (for example, TCP = 6, UDP = 17) */
struct in_addr src_ip; /* Source IP Address */
struct in_addr dst_ip; /* Destination IP Address */
uint32_t src_port; /* TCP/UDP source port number or equivalent */
uint32_t dst_port; /* TCP/UDP destination port number or equivalent */
uint32_t tcp_flags; /* TCP flags */
uint32_t tos; /* IP type of service */
} SFLSampled_ipv4;
/* decoded IP version 6 data */
typedef struct _SFLSampled_ipv6 {
uint32_t length; /* The length of the IP packet
excluding lower layer encapsulations */
uint32_t protocol; /* IP Protocol type (for example, TCP = 6, UDP = 17) */
struct in6_addr src_ip; /* Source IP Address */
struct in6_addr dst_ip; /* Destination IP Address */
uint32_t src_port; /* TCP/UDP source port number or equivalent */
uint32_t dst_port; /* TCP/UDP destination port number or equivalent */
uint32_t tcp_flags; /* TCP flags */
uint32_t priority; /* IP priority */
} SFLSampled_ipv6;
/* Extended data types */
/* Extended switch data */
typedef struct _SFLExtended_switch {
uint32_t src_vlan; /* The 802.1Q VLAN id of incomming frame */
uint32_t src_priority; /* The 802.1p priority */
uint32_t dst_vlan; /* The 802.1Q VLAN id of outgoing frame */
uint32_t dst_priority; /* The 802.1p priority */
} SFLExtended_switch;
/* Extended router data */
typedef struct _SFLExtended_router {
SFLAddress nexthop; /* IP address of next hop router */
uint32_t src_mask; /* Source address prefix mask bits */
uint32_t dst_mask; /* Destination address prefix mask bits */
} SFLExtended_router;
/* Extended gateway data */
enum SFLExtended_as_path_segment_type {
SFLEXTENDED_AS_SET = 1, /* Unordered set of ASs */
SFLEXTENDED_AS_SEQUENCE = 2 /* Ordered sequence of ASs */
};
typedef struct _SFLExtended_as_path_segment {
uint32_t type; /* enum SFLExtended_as_path_segment_type */
uint32_t length; /* number of AS numbers in set/sequence */
union {
uint32_t *set;
uint32_t *seq;
} as;
} SFLExtended_as_path_segment;
typedef struct _SFLExtended_gateway {
SFLAddress nexthop; /* Address of the border router that should
be used for the destination network */
uint32_t as; /* AS number for this gateway */
uint32_t src_as; /* AS number of source (origin) */
uint32_t src_peer_as; /* AS number of source peer */
uint32_t dst_as_path_segments; /* number of segments in path */
SFLExtended_as_path_segment *dst_as_path; /* list of seqs or sets */
uint32_t communities_length; /* number of communities */
uint32_t *communities; /* set of communities */
uint32_t localpref; /* LocalPref associated with this route */
} SFLExtended_gateway;
typedef struct _SFLString {
uint32_t len;
char *str;
} SFLString;
/* Extended user data */
typedef struct _SFLExtended_user {
uint32_t src_charset; /* MIBEnum value of character set used to encode a string - See RFC 2978
Where possible UTF-8 encoding (MIBEnum=106) should be used. A value
of zero indicates an unknown encoding. */
SFLString src_user;
uint32_t dst_charset;
SFLString dst_user;
} SFLExtended_user;
/* Extended URL data */
enum SFLExtended_url_direction {
SFLEXTENDED_URL_SRC = 1, /* URL is associated with source address */
SFLEXTENDED_URL_DST = 2 /* URL is associated with destination address */
};
typedef struct _SFLExtended_url {
uint32_t direction; /* enum SFLExtended_url_direction */
SFLString url; /* URL associated with the packet flow.
Must be URL encoded */
SFLString host; /* The host field from the HTTP header */
} SFLExtended_url;
/* Extended MPLS data */
typedef struct _SFLLabelStack {
uint32_t depth;
uint32_t *stack; /* first entry is top of stack - see RFC 3032 for encoding */
} SFLLabelStack;
typedef struct _SFLExtended_mpls {
SFLAddress nextHop; /* Address of the next hop */
SFLLabelStack in_stack;
SFLLabelStack out_stack;
} SFLExtended_mpls;
/* Extended NAT data
Packet header records report addresses as seen at the sFlowDataSource.
The extended_nat structure reports on translated source and/or destination
addesses for this packet. If an address was not translated it should
be equal to that reported for the header. */
typedef struct _SFLExtended_nat {
SFLAddress src; /* Source address */
SFLAddress dst; /* Destination address */
} SFLExtended_nat;
/* additional Extended MPLS stucts */
typedef struct _SFLExtended_mpls_tunnel {
SFLString tunnel_lsp_name; /* Tunnel name */
uint32_t tunnel_id; /* Tunnel ID */
uint32_t tunnel_cos; /* Tunnel COS value */
} SFLExtended_mpls_tunnel;
typedef struct _SFLExtended_mpls_vc {
SFLString vc_instance_name; /* VC instance name */
uint32_t vll_vc_id; /* VLL/VC instance ID */
uint32_t vc_label_cos; /* VC Label COS value */
} SFLExtended_mpls_vc;
/* Extended MPLS FEC
- Definitions from MPLS-FTN-STD-MIB mplsFTNTable */
typedef struct _SFLExtended_mpls_FTN {
SFLString mplsFTNDescr;
uint32_t mplsFTNMask;
} SFLExtended_mpls_FTN;
/* Extended MPLS LVP FEC
- Definition from MPLS-LDP-STD-MIB mplsFecTable
Note: mplsFecAddrType, mplsFecAddr information available
from packet header */
typedef struct _SFLExtended_mpls_LDP_FEC {
uint32_t mplsFecAddrPrefixLength;
} SFLExtended_mpls_LDP_FEC;
/* Extended VLAN tunnel information
Record outer VLAN encapsulations that have
been stripped. extended_vlantunnel information
should only be reported if all the following conditions are satisfied:
1. The packet has nested vlan tags, AND
2. The reporting device is VLAN aware, AND
3. One or more VLAN tags have been stripped, either
because they represent proprietary encapsulations, or
because switch hardware automatically strips the outer VLAN
encapsulation.
Reporting extended_vlantunnel information is not a substitute for
reporting extended_switch information. extended_switch data must
always be reported to describe the ingress/egress VLAN information
for the packet. The extended_vlantunnel information only applies to
nested VLAN tags, and then only when one or more tags has been
stripped. */
typedef SFLLabelStack SFLVlanStack;
typedef struct _SFLExtended_vlan_tunnel {
SFLVlanStack stack; /* List of stripped 802.1Q TPID/TCI layers. Each
TPID,TCI pair is represented as a single 32 bit
integer. Layers listed from outermost to
innermost. */
} SFLExtended_vlan_tunnel;
////////////////// InMon Extension structs //////////////////////////
typedef struct _SFLProcess {
uint32_t pid;
SFLString command;
} SFLProcess;
#define SFL_MAX_PROCESSES 10
typedef struct _SFLExtended_process {
uint32_t num_processes;
SFLProcess processes[SFL_MAX_PROCESSES];
} SFLExtended_process;
//////////////////////////////////////////////////////////////////////
enum SFLFlow_type_tag {
/* enterprise = 0, format = ... */
SFLFLOW_HEADER = 1, /* Packet headers are sampled */
SFLFLOW_ETHERNET = 2, /* MAC layer information */
SFLFLOW_IPV4 = 3, /* IP version 4 data */
SFLFLOW_IPV6 = 4, /* IP version 6 data */
SFLFLOW_EX_SWITCH = 1001, /* Extended switch information */
SFLFLOW_EX_ROUTER = 1002, /* Extended router information */
SFLFLOW_EX_GATEWAY = 1003, /* Extended gateway router information */
SFLFLOW_EX_USER = 1004, /* Extended TACAS/RADIUS user information */
SFLFLOW_EX_URL = 1005, /* Extended URL information */
SFLFLOW_EX_MPLS = 1006, /* Extended MPLS information */
SFLFLOW_EX_NAT = 1007, /* Extended NAT information */
SFLFLOW_EX_MPLS_TUNNEL = 1008, /* additional MPLS information */
SFLFLOW_EX_MPLS_VC = 1009,
SFLFLOW_EX_MPLS_FTN = 1010,
SFLFLOW_EX_MPLS_LDP_FEC = 1011,
SFLFLOW_EX_VLAN_TUNNEL = 1012, /* VLAN stack */
/* enterprise = 4300 (inmon)...*/
SFLFLOW_EX_PROCESS = (4300 << 12) + 3, /* =17612803 Extended Process information */
};
typedef union _SFLFlow_type {
SFLSampled_header header;
SFLSampled_ethernet ethernet;
SFLSampled_ipv4 ipv4;
SFLSampled_ipv6 ipv6;
SFLExtended_switch sw;
SFLExtended_router router;
SFLExtended_gateway gateway;
SFLExtended_user user;
SFLExtended_url url;
SFLExtended_mpls mpls;
SFLExtended_nat nat;
SFLExtended_mpls_tunnel mpls_tunnel;
SFLExtended_mpls_vc mpls_vc;
SFLExtended_mpls_FTN mpls_ftn;
SFLExtended_mpls_LDP_FEC mpls_ldp_fec;
SFLExtended_vlan_tunnel vlan_tunnel;
// extensions
SFLExtended_process process;
} SFLFlow_type;
typedef struct _SFLFlow_sample_element {
struct _SFLFlow_sample_element *nxt;
uint32_t tag; /* SFLFlow_type_tag */
uint32_t length;
SFLFlow_type flowType;
} SFLFlow_sample_element;
enum SFL_sample_tag {
SFLFLOW_SAMPLE = 1, /* enterprise = 0 : format = 1 */
SFLCOUNTERS_SAMPLE = 2, /* enterprise = 0 : format = 2 */
SFLFLOW_SAMPLE_EXPANDED = 3, /* enterprise = 0 : format = 3 */
SFLCOUNTERS_SAMPLE_EXPANDED = 4 /* enterprise = 0 : format = 4 */
};
/* Format of a single flow sample */
typedef struct _SFLFlow_sample {
/* uint32_t tag; */ /* SFL_sample_tag -- enterprise = 0 : format = 1 */
/* uint32_t length; */
uint32_t sequence_number; /* Incremented with each flow sample
generated */
uint32_t source_id; /* fsSourceId */
uint32_t sampling_rate; /* fsPacketSamplingRate */
uint32_t sample_pool; /* Total number of packets that could have been
sampled (i.e. packets skipped by sampling
process + total number of samples) */
uint32_t drops; /* Number of times a packet was dropped due to
lack of resources */
uint32_t input; /* SNMP ifIndex of input interface.
0 if interface is not known. */
uint32_t output; /* SNMP ifIndex of output interface,
0 if interface is not known.
Set most significant bit to indicate
multiple destination interfaces
(i.e. in case of broadcast or multicast)
and set lower order bits to indicate
number of destination interfaces.
Examples:
0x00000002 indicates ifIndex = 2
0x00000000 ifIndex unknown.
0x80000007 indicates a packet sent
to 7 interfaces.
0x80000000 indicates a packet sent to
an unknown number of
interfaces greater than 1.*/
uint32_t num_elements;
SFLFlow_sample_element *elements;
} SFLFlow_sample;
/* same thing, but the expanded version (for full 32-bit ifIndex numbers) */
typedef struct _SFLFlow_sample_expanded {
/* uint32_t tag; */ /* SFL_sample_tag -- enterprise = 0 : format = 1 */
/* uint32_t length; */
uint32_t sequence_number; /* Incremented with each flow sample
generated */
uint32_t ds_class; /* EXPANDED */
uint32_t ds_index; /* EXPANDED */
uint32_t sampling_rate; /* fsPacketSamplingRate */
uint32_t sample_pool; /* Total number of packets that could have been
sampled (i.e. packets skipped by sampling
process + total number of samples) */
uint32_t drops; /* Number of times a packet was dropped due to
lack of resources */
uint32_t inputFormat; /* EXPANDED */
uint32_t input; /* SNMP ifIndex of input interface.
0 if interface is not known. */
uint32_t outputFormat; /* EXPANDED */
uint32_t output; /* SNMP ifIndex of output interface,
0 if interface is not known. */
uint32_t num_elements;
SFLFlow_sample_element *elements;
} SFLFlow_sample_expanded;
/* Counter types */
/* Generic interface counters - see RFC 1573, 2233 */
typedef struct _SFLIf_counters {
uint32_t ifIndex;
uint32_t ifType;
uint64_t ifSpeed;
uint32_t ifDirection; /* Derived from MAU MIB (RFC 2668)
0 = unknown, 1 = full-duplex,
2 = half-duplex, 3 = in, 4 = out */
uint32_t ifStatus; /* bit field with the following bits assigned:
bit 0 = ifAdminStatus (0 = down, 1 = up)
bit 1 = ifOperStatus (0 = down, 1 = up) */
uint64_t ifInOctets;
uint32_t ifInUcastPkts;
uint32_t ifInMulticastPkts;
uint32_t ifInBroadcastPkts;
uint32_t ifInDiscards;
uint32_t ifInErrors;
uint32_t ifInUnknownProtos;
uint64_t ifOutOctets;
uint32_t ifOutUcastPkts;
uint32_t ifOutMulticastPkts;
uint32_t ifOutBroadcastPkts;
uint32_t ifOutDiscards;
uint32_t ifOutErrors;
uint32_t ifPromiscuousMode;
} SFLIf_counters;
/* Ethernet interface counters - see RFC 2358 */
typedef struct _SFLEthernet_counters {
uint32_t dot3StatsAlignmentErrors;
uint32_t dot3StatsFCSErrors;
uint32_t dot3StatsSingleCollisionFrames;
uint32_t dot3StatsMultipleCollisionFrames;
uint32_t dot3StatsSQETestErrors;
uint32_t dot3StatsDeferredTransmissions;
uint32_t dot3StatsLateCollisions;
uint32_t dot3StatsExcessiveCollisions;
uint32_t dot3StatsInternalMacTransmitErrors;
uint32_t dot3StatsCarrierSenseErrors;
uint32_t dot3StatsFrameTooLongs;
uint32_t dot3StatsInternalMacReceiveErrors;
uint32_t dot3StatsSymbolErrors;
} SFLEthernet_counters;
/* Token ring counters - see RFC 1748 */
typedef struct _SFLTokenring_counters {
uint32_t dot5StatsLineErrors;
uint32_t dot5StatsBurstErrors;
uint32_t dot5StatsACErrors;
uint32_t dot5StatsAbortTransErrors;
uint32_t dot5StatsInternalErrors;
uint32_t dot5StatsLostFrameErrors;
uint32_t dot5StatsReceiveCongestions;
uint32_t dot5StatsFrameCopiedErrors;
uint32_t dot5StatsTokenErrors;
uint32_t dot5StatsSoftErrors;
uint32_t dot5StatsHardErrors;
uint32_t dot5StatsSignalLoss;
uint32_t dot5StatsTransmitBeacons;
uint32_t dot5StatsRecoverys;
uint32_t dot5StatsLobeWires;
uint32_t dot5StatsRemoves;
uint32_t dot5StatsSingles;
uint32_t dot5StatsFreqErrors;
} SFLTokenring_counters;
/* 100 BaseVG interface counters - see RFC 2020 */
typedef struct _SFLVg_counters {
uint32_t dot12InHighPriorityFrames;
uint64_t dot12InHighPriorityOctets;
uint32_t dot12InNormPriorityFrames;
uint64_t dot12InNormPriorityOctets;
uint32_t dot12InIPMErrors;
uint32_t dot12InOversizeFrameErrors;
uint32_t dot12InDataErrors;
uint32_t dot12InNullAddressedFrames;
uint32_t dot12OutHighPriorityFrames;
uint64_t dot12OutHighPriorityOctets;
uint32_t dot12TransitionIntoTrainings;
uint64_t dot12HCInHighPriorityOctets;
uint64_t dot12HCInNormPriorityOctets;
uint64_t dot12HCOutHighPriorityOctets;
} SFLVg_counters;
typedef struct _SFLVlan_counters {
uint32_t vlan_id;
uint64_t octets;
uint32_t ucastPkts;
uint32_t multicastPkts;
uint32_t broadcastPkts;
uint32_t discards;
} SFLVlan_counters;
/* Processor Information */
/* opaque = counter_data; enterprise = 0; format = 1001 */
typedef struct _SFLProcessor_counters {
uint32_t five_sec_cpu; /* 5 second average CPU utilization */
uint32_t one_min_cpu; /* 1 minute average CPU utilization */
uint32_t five_min_cpu; /* 5 minute average CPU utilization */
uint64_t total_memory; /* total memory (in bytes) */
uint64_t free_memory; /* free memory (in bytes) */
} SFLProcessor_counters;
/* Counters data */
enum SFLCounters_type_tag {
/* enterprise = 0, format = ... */
SFLCOUNTERS_GENERIC = 1,
SFLCOUNTERS_ETHERNET = 2,
SFLCOUNTERS_TOKENRING = 3,
SFLCOUNTERS_VG = 4,
SFLCOUNTERS_VLAN = 5,
SFLCOUNTERS_PROCESSOR = 1001
};
typedef union _SFLCounters_type {
SFLIf_counters generic;
SFLEthernet_counters ethernet;
SFLTokenring_counters tokenring;
SFLVg_counters vg;
SFLVlan_counters vlan;
SFLProcessor_counters processor;
} SFLCounters_type;
typedef struct _SFLCounters_sample_element {
struct _SFLCounters_sample_element *nxt; /* linked list */
uint32_t tag; /* SFLCounters_type_tag */
uint32_t length;
SFLCounters_type counterBlock;
} SFLCounters_sample_element;
typedef struct _SFLCounters_sample {
/* uint32_t tag; */ /* SFL_sample_tag -- enterprise = 0 : format = 2 */
/* uint32_t length; */
uint32_t sequence_number; /* Incremented with each counters sample
generated by this source_id */
uint32_t source_id; /* fsSourceId */
uint32_t num_elements;
SFLCounters_sample_element *elements;
} SFLCounters_sample;
/* same thing, but the expanded version, so ds_index can be a full 32 bits */
typedef struct _SFLCounters_sample_expanded {
/* uint32_t tag; */ /* SFL_sample_tag -- enterprise = 0 : format = 2 */
/* uint32_t length; */
uint32_t sequence_number; /* Incremented with each counters sample
generated by this source_id */
uint32_t ds_class; /* EXPANDED */
uint32_t ds_index; /* EXPANDED */
uint32_t num_elements;
SFLCounters_sample_element *elements;
} SFLCounters_sample_expanded;
#define SFLADD_ELEMENT(_sm, _el) do { (_el)->nxt = (_sm)->elements; (_sm)->elements = (_el); } while(0)
/* Format of a sample datagram */
enum SFLDatagram_version {
SFLDATAGRAM_VERSION2 = 2,
SFLDATAGRAM_VERSION4 = 4,
SFLDATAGRAM_VERSION5 = 5
};
typedef struct _SFLSample_datagram_hdr {
uint32_t datagram_version; /* (enum SFLDatagram_version) = VERSION5 = 5 */
SFLAddress agent_address; /* IP address of sampling agent */
uint32_t sub_agent_id; /* Used to distinguishing between datagram
streams from separate agent sub entities
within an device. */
uint32_t sequence_number; /* Incremented with each sample datagram
generated */
uint32_t uptime; /* Current time (in milliseconds since device
last booted). Should be set as close to
datagram transmission time as possible.*/
uint32_t num_records; /* Number of tag-len-val flow/counter records to follow */
} SFLSample_datagram_hdr;
#define SFL_MAX_DATAGRAM_SIZE 1500
#define SFL_MIN_DATAGRAM_SIZE 200
#define SFL_DEFAULT_DATAGRAM_SIZE 1400
#define SFL_DATA_PAD 400
#if defined(__cplusplus)
} /* extern "C" */
#endif
#endif /* _SFLOW_PROTO_H */

436
bin/sflow_v2v4.h Executable file
View File

@ -0,0 +1,436 @@
/* Copyright (c) 2002-2011 InMon Corp. Licensed under the terms of the InMon sFlow licence: */
/* http://www.inmon.com/technology/sflowlicense.txt */
#ifndef SFLOW_V2V4_H
#define SFLOW_V2V4_H 1
#if defined(__cplusplus)
extern "C" {
#endif
enum INMAddress_type {
INMADDRESSTYPE_IP_V4 = 1,
INMADDRESSTYPE_IP_V6 = 2
};
typedef union _INMAddress_value {
SFLIPv4 ip_v4;
SFLIPv6 ip_v6;
} INMAddress_value;
typedef struct _INMAddress {
uint32_t type; /* enum INMAddress_type */
INMAddress_value address;
} INMAddress;
/* Packet header data */
#define INM_MAX_HEADER_SIZE 256 /* The maximum sampled header size. */
#define INM_DEFAULT_HEADER_SIZE 128
#define INM_DEFAULT_COLLECTOR_PORT 6343
#define INM_DEFAULT_SAMPLING_RATE 400
/* The header protocol describes the format of the sampled header */
enum INMHeader_protocol {
INMHEADER_ETHERNET_ISO8023 = 1,
INMHEADER_ISO88024_TOKENBUS = 2,
INMHEADER_ISO88025_TOKENRING = 3,
INMHEADER_FDDI = 4,
INMHEADER_FRAME_RELAY = 5,
INMHEADER_X25 = 6,
INMHEADER_PPP = 7,
INMHEADER_SMDS = 8,
INMHEADER_AAL5 = 9,
INMHEADER_AAL5_IP = 10, /* e.g. Cisco AAL5 mux */
INMHEADER_IPv4 = 11,
INMHEADER_IPv6 = 12
};
typedef struct _INMSampled_header {
uint32_t header_protocol; /* (enum INMHeader_protocol) */
uint32_t frame_length; /* Original length of packet before sampling */
uint32_t header_length; /* length of sampled header bytes to follow */
uint8_t header[INM_MAX_HEADER_SIZE]; /* Header bytes */
} INMSampled_header;
/* Packet IP version 4 data */
typedef struct _INMSampled_ipv4 {
uint32_t length; /* The length of the IP packet
excluding lower layer encapsulations */
uint32_t protocol; /* IP Protocol type (for example, TCP = 6, UDP = 17) */
SFLIPv4 src_ip; /* Source IP Address */
SFLIPv4 dst_ip; /* Destination IP Address */
uint32_t src_port; /* TCP/UDP source port number or equivalent */
uint32_t dst_port; /* TCP/UDP destination port number or equivalent */
uint32_t tcp_flags; /* TCP flags */
uint32_t tos; /* IP type of service */
} INMSampled_ipv4;
/* Packet IP version 6 data */
typedef struct _INMSampled_ipv6 {
uint32_t length; /* The length of the IP packet
excluding lower layer encapsulations */
uint32_t protocol; /* IP Protocol type (for example, TCP = 6, UDP = 17) */
SFLIPv6 src_ip; /* Source IP Address */
SFLIPv6 dst_ip; /* Destination IP Address */
uint32_t src_port; /* TCP/UDP source port number or equivalent */
uint32_t dst_port; /* TCP/UDP destination port number or equivalent */
uint32_t tcp_flags; /* TCP flags */
uint32_t tos; /* IP type of service */
} INMSampled_ipv6;
/* Packet data */
enum INMPacket_information_type {
INMPACKETTYPE_HEADER = 1, /* Packet headers are sampled */
INMPACKETTYPE_IPV4 = 2, /* IP version 4 data */
INMPACKETTYPE_IPV6 = 3 /* IP version 4 data */
};
typedef union _INMPacket_data_type {
INMSampled_header header;
INMSampled_ipv4 ipv4;
INMSampled_ipv6 ipv6;
} INMPacket_data_type;
/* Extended data types */
/* Extended switch data */
typedef struct _INMExtended_switch {
uint32_t src_vlan; /* The 802.1Q VLAN id of incomming frame */
uint32_t src_priority; /* The 802.1p priority */
uint32_t dst_vlan; /* The 802.1Q VLAN id of outgoing frame */
uint32_t dst_priority; /* The 802.1p priority */
} INMExtended_switch;
/* Extended router data */
typedef struct _INMExtended_router {
INMAddress nexthop; /* IP address of next hop router */
uint32_t src_mask; /* Source address prefix mask bits */
uint32_t dst_mask; /* Destination address prefix mask bits */
} INMExtended_router;
/* Extended gateway data */
enum INMExtended_as_path_segment_type {
INMEXTENDED_AS_SET = 1, /* Unordered set of ASs */
INMEXTENDED_AS_SEQUENCE = 2 /* Ordered sequence of ASs */
};
typedef struct _INMExtended_as_path_segment {
uint32_t type; /* enum INMExtended_as_path_segment_type */
uint32_t length; /* number of AS numbers in set/sequence */
union {
uint32_t *set;
uint32_t *seq;
} as;
} INMExtended_as_path_segment;
/* note: the INMExtended_gateway structure has changed between v2 and v4.
Here is the old version first... */
typedef struct _INMExtended_gateway_v2 {
uint32_t as; /* AS number for this gateway */
uint32_t src_as; /* AS number of source (origin) */
uint32_t src_peer_as; /* AS number of source peer */
uint32_t dst_as_path_length; /* number of AS numbers in path */
uint32_t *dst_as_path;
} INMExtended_gateway_v2;
/* now here is the new version... */
typedef struct _INMExtended_gateway_v4 {
uint32_t as; /* AS number for this gateway */
uint32_t src_as; /* AS number of source (origin) */
uint32_t src_peer_as; /* AS number of source peer */
uint32_t dst_as_path_segments; /* number of segments in path */
INMExtended_as_path_segment *dst_as_path; /* list of seqs or sets */
uint32_t communities_length; /* number of communities */
uint32_t *communities; /* set of communities */
uint32_t localpref; /* LocalPref associated with this route */
} INMExtended_gateway_v4;
/* Extended user data */
typedef struct _INMExtended_user {
uint32_t src_user_len;
char *src_user;
uint32_t dst_user_len;
char *dst_user;
} INMExtended_user;
enum INMExtended_url_direction {
INMEXTENDED_URL_SRC = 1, /* URL is associated with source address */
INMEXTENDED_URL_DST = 2 /* URL is associated with destination address */
};
typedef struct _INMExtended_url {
uint32_t direction; /* enum INMExtended_url_direction */
uint32_t url_len;
char *url;
} INMExtended_url;
/* Extended data */
enum INMExtended_information_type {
INMEXTENDED_SWITCH = 1, /* Extended switch information */
INMEXTENDED_ROUTER = 2, /* Extended router information */
INMEXTENDED_GATEWAY = 3, /* Extended gateway router information */
INMEXTENDED_USER = 4, /* Extended TACAS/RADIUS user information */
INMEXTENDED_URL = 5 /* Extended URL information */
};
/* Format of a single sample */
typedef struct _INMFlow_sample {
uint32_t sequence_number; /* Incremented with each flow sample
generated */
uint32_t source_id; /* fsSourceId */
uint32_t sampling_rate; /* fsPacketSamplingRate */
uint32_t sample_pool; /* Total number of packets that could have been
sampled (i.e. packets skipped by sampling
process + total number of samples) */
uint32_t drops; /* Number of times a packet was dropped due to
lack of resources */
uint32_t input; /* SNMP ifIndex of input interface.
0 if interface is not known. */
uint32_t output; /* SNMP ifIndex of output interface,
0 if interface is not known.
Set most significant bit to indicate
multiple destination interfaces
(i.e. in case of broadcast or multicast)
and set lower order bits to indicate
number of destination interfaces.
Examples:
0x00000002 indicates ifIndex = 2
0x00000000 ifIndex unknown.
0x80000007 indicates a packet sent
to 7 interfaces.
0x80000000 indicates a packet sent to
an unknown number of
interfaces greater than 1.*/
uint32_t packet_data_tag; /* enum INMPacket_information_type */
INMPacket_data_type packet_data; /* Information about sampled packet */
/* in the sFlow packet spec the next field is the number of extended objects
followed by the data for each one (tagged with the type). Here we just
provide space for each one, and flags to enable them. The correct format
is then put together by the serialization code */
int gotSwitch;
INMExtended_switch switchDevice;
int gotRouter;
INMExtended_router router;
int gotGateway;
union {
INMExtended_gateway_v2 v2; /* make the version explicit so that there is */
INMExtended_gateway_v4 v4; /* less danger of mistakes when upgrading code */
} gateway;
int gotUser;
INMExtended_user user;
int gotUrl;
INMExtended_url url;
} INMFlow_sample;
/* Counter types */
/* Generic interface counters - see RFC 1573, 2233 */
typedef struct _INMIf_counters {
uint32_t ifIndex;
uint32_t ifType;
uint64_t ifSpeed;
uint32_t ifDirection; /* Derived from MAU MIB (RFC 2239)
0 = unknown, 1 = full-duplex,
2 = half-duplex, 3 = in, 4 = out */
uint32_t ifStatus; /* bit field with the following bits assigned:
bit 0 = ifAdminStatus (0 = down, 1 = up)
bit 1 = ifOperStatus (0 = down, 1 = up) */
uint64_t ifInOctets;
uint32_t ifInUcastPkts;
uint32_t ifInMulticastPkts;
uint32_t ifInBroadcastPkts;
uint32_t ifInDiscards;
uint32_t ifInErrors;
uint32_t ifInUnknownProtos;
uint64_t ifOutOctets;
uint32_t ifOutUcastPkts;
uint32_t ifOutMulticastPkts;
uint32_t ifOutBroadcastPkts;
uint32_t ifOutDiscards;
uint32_t ifOutErrors;
uint32_t ifPromiscuousMode;
} INMIf_counters;
/* Ethernet interface counters - see RFC 2358 */
typedef struct _INMEthernet_specific_counters {
uint32_t dot3StatsAlignmentErrors;
uint32_t dot3StatsFCSErrors;
uint32_t dot3StatsSingleCollisionFrames;
uint32_t dot3StatsMultipleCollisionFrames;
uint32_t dot3StatsSQETestErrors;
uint32_t dot3StatsDeferredTransmissions;
uint32_t dot3StatsLateCollisions;
uint32_t dot3StatsExcessiveCollisions;
uint32_t dot3StatsInternalMacTransmitErrors;
uint32_t dot3StatsCarrierSenseErrors;
uint32_t dot3StatsFrameTooLongs;
uint32_t dot3StatsInternalMacReceiveErrors;
uint32_t dot3StatsSymbolErrors;
} INMEthernet_specific_counters;
typedef struct _INMEthernet_counters {
INMIf_counters generic;
INMEthernet_specific_counters ethernet;
} INMEthernet_counters;
/* FDDI interface counters - see RFC 1512 */
typedef struct _INMFddi_counters {
INMIf_counters generic;
} INMFddi_counters;
/* Token ring counters - see RFC 1748 */
typedef struct _INMTokenring_specific_counters {
uint32_t dot5StatsLineErrors;
uint32_t dot5StatsBurstErrors;
uint32_t dot5StatsACErrors;
uint32_t dot5StatsAbortTransErrors;
uint32_t dot5StatsInternalErrors;
uint32_t dot5StatsLostFrameErrors;
uint32_t dot5StatsReceiveCongestions;
uint32_t dot5StatsFrameCopiedErrors;
uint32_t dot5StatsTokenErrors;
uint32_t dot5StatsSoftErrors;
uint32_t dot5StatsHardErrors;
uint32_t dot5StatsSignalLoss;
uint32_t dot5StatsTransmitBeacons;
uint32_t dot5StatsRecoverys;
uint32_t dot5StatsLobeWires;
uint32_t dot5StatsRemoves;
uint32_t dot5StatsSingles;
uint32_t dot5StatsFreqErrors;
} INMTokenring_specific_counters;
typedef struct _INMTokenring_counters {
INMIf_counters generic;
INMTokenring_specific_counters tokenring;
} INMTokenring_counters;
/* 100 BaseVG interface counters - see RFC 2020 */
typedef struct _INMVg_specific_counters {
uint32_t dot12InHighPriorityFrames;
uint64_t dot12InHighPriorityOctets;
uint32_t dot12InNormPriorityFrames;
uint64_t dot12InNormPriorityOctets;
uint32_t dot12InIPMErrors;
uint32_t dot12InOversizeFrameErrors;
uint32_t dot12InDataErrors;
uint32_t dot12InNullAddressedFrames;
uint32_t dot12OutHighPriorityFrames;
uint64_t dot12OutHighPriorityOctets;
uint32_t dot12TransitionIntoTrainings;
uint64_t dot12HCInHighPriorityOctets;
uint64_t dot12HCInNormPriorityOctets;
uint64_t dot12HCOutHighPriorityOctets;
} INMVg_specific_counters;
typedef struct _INMVg_counters {
INMIf_counters generic;
INMVg_specific_counters vg;
} INMVg_counters;
/* WAN counters */
typedef struct _INMWan_counters {
INMIf_counters generic;
} INMWan_counters;
typedef struct _INMVlan_counters {
uint32_t vlan_id;
uint64_t octets;
uint32_t ucastPkts;
uint32_t multicastPkts;
uint32_t broadcastPkts;
uint32_t discards;
} INMVlan_counters;
/* Counters data */
enum INMCounters_version {
INMCOUNTERSVERSION_GENERIC = 1,
INMCOUNTERSVERSION_ETHERNET = 2,
INMCOUNTERSVERSION_TOKENRING = 3,
INMCOUNTERSVERSION_FDDI = 4,
INMCOUNTERSVERSION_VG = 5,
INMCOUNTERSVERSION_WAN = 6,
INMCOUNTERSVERSION_VLAN = 7
};
typedef union _INMCounters_type {
INMIf_counters generic;
INMEthernet_counters ethernet;
INMTokenring_counters tokenring;
INMFddi_counters fddi;
INMVg_counters vg;
INMWan_counters wan;
INMVlan_counters vlan;
} INMCounters_type;
typedef struct _INMCounters_sample_hdr {
uint32_t sequence_number; /* Incremented with each counters sample
generated by this source_id */
uint32_t source_id; /* fsSourceId */
uint32_t sampling_interval; /* fsCounterSamplingInterval */
} INMCounters_sample_hdr;
typedef struct _INMCounters_sample {
INMCounters_sample_hdr hdr;
uint32_t counters_type_tag; /* Enum INMCounters_version */
INMCounters_type counters; /* Counter set for this interface type */
} INMCounters_sample;
/* when I turn on optimisation with the Microsoft compiler it seems to change
the values of these enumerated types and break the program - not sure why */
enum INMSample_types {
FLOWSAMPLE = 1,
COUNTERSSAMPLE = 2
};
typedef union _INMSample_type {
INMFlow_sample flowsample;
INMCounters_sample counterssample;
} INMSample_type;
/* Format of a sample datagram */
enum INMDatagram_version {
INMDATAGRAM_VERSION2 = 2,
INMDATAGRAM_VERSION4 = 4
};
typedef struct _INMSample_datagram_hdr {
uint32_t datagram_version; /* (enum INMDatagram_version) = VERSION4 */
INMAddress agent_address; /* IP address of sampling agent */
uint32_t sequence_number; /* Incremented with each sample datagram
generated */
uint32_t uptime; /* Current time (in milliseconds since device
last booted). Should be set as close to
datagram transmission time as possible.*/
uint32_t num_samples; /* Number of flow and counters samples to follow */
} INMSample_datagram_hdr;
#define INM_MAX_DATAGRAM_SIZE 1500
#define INM_MIN_DATAGRAM_SIZE 200
#define INM_DEFAULT_DATAGRAM_SIZE 1400
#define INM_DATA_PAD 400
#if defined(__cplusplus)
} /* extern "C" */
#endif
#endif /* SFLOW_V2V4_H */